Analysis
-
max time kernel
144s -
max time network
119s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
-
submitted
29/12/2023, 23:29
General
-
Target
06ef0e9c7fc04425abcbce61a26903b2.exe
-
Size
3.9MB
-
MD5
06ef0e9c7fc04425abcbce61a26903b2
-
SHA1
e8ca517d42a0d6193879fcec9da3c311f1a012b2
-
SHA256
69e8a7c335ad0760b5ba89b6b918f67ef4676cdf40442c344a96e3a6a47805e1
-
SHA512
7f4f2956d4ebaebc3c3668076f60d3791542a27409139d31fd2a6cceecb58a6f1fe0cd4a21fcff69522b2a34b9550e72865028381dfa446e98785b37dc8a9204
-
SSDEEP
98304:UkYCYvKGJW1Te5rg/ba0ygg3gnl/IVURsHzyHgg3gnl/IVUV:UMwnJW1TexObNWgl/ibulgl/iG
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\06ef0e9c7fc04425abcbce61a26903b2.exe"C:\Users\Admin\AppData\Local\Temp\06ef0e9c7fc04425abcbce61a26903b2.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\06ef0e9c7fc04425abcbce61a26903b2.exeC:\Users\Admin\AppData\Local\Temp\06ef0e9c7fc04425abcbce61a26903b2.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
109KB
MD5b974e8baafdbe43918bb3b02ce92505f
SHA15136141448a55a0476182aec367137578836a308
SHA2568d743bd13d56bcc4869053876ae4087b4bbbcda5156682a08b8b3c0a83e16a6a
SHA51200b48ac4c915ef2cc54d74c0738b5ff0ddee86b026e6153b46f9ea490c83c5f64ce01658f96617216841e2f85b47a17976f6fbbbce38bb2bec626a9276e860d7
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
4.9MB
-
Filesize
2.2MB
-
Filesize
4.9MB
-
Filesize
2.1MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
1.2MB
-
Filesize
4.9MB