Analysis
-
max time kernel
165s -
max time network
179s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
29-12-2023 23:18
General
-
Target
06b31ea7b3ef199210937db218b59325.exe
-
Size
2.7MB
-
MD5
06b31ea7b3ef199210937db218b59325
-
SHA1
b1952fda0179710adb82b70a44e7ad004e074b90
-
SHA256
51089d078f867ad4311c2fb0101b141e93ffd3370ec0a6324ff35bd9e36a8922
-
SHA512
cfa1098aa3b1b0b604075d8e5c8a41b3f7f253b7723a855ba60d0f007592f0a8da7a4cb0ebf4fd3aeb884ed69d1de0a3193b994dd5eecec7d7920d90698b8d9f
-
SSDEEP
49152:59bEXCkjVogC4NUKTjwYgfawN74NH5HUyNRcUsCVOzetdZk:zbEXCkpom3MYw4HBUCczzMO
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\06b31ea7b3ef199210937db218b59325.exe"C:\Users\Admin\AppData\Local\Temp\06b31ea7b3ef199210937db218b59325.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\06b31ea7b3ef199210937db218b59325.exeC:\Users\Admin\AppData\Local\Temp\06b31ea7b3ef199210937db218b59325.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.7MB
MD59fcf16bc3506bf6a7bb33a6475b457a7
SHA1433ac749653ab01eabeb368c7ed2eb98423f3b5b
SHA2568cff4db342c1b31c4849da96c9420d7a06408aefa57a314c6b1610a9eea419bf
SHA512f2de12e61ec4f8256b70ff5f5bdac1d3e095bc8335106ea33c0627434e28ccba883643d3150c0bcdf1a7d704a989f5a94d1cb53475e8e40d6c99dce36911f27c
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
4.9MB
-
Filesize
2.2MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
2.1MB
-
Filesize
4.9MB