Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
29/12/2023, 23:29
General
-
Target
06f135e5e78816588bc88d26bda4292e.exe
-
Size
1.3MB
-
MD5
06f135e5e78816588bc88d26bda4292e
-
SHA1
f42da220a527365961d7c7a4f386798de5028997
-
SHA256
9714147ae6c9bb905c21a4b6ccdc343c48afeb43620ddbb89c81c5d68b216e2a
-
SHA512
97331118f75ffc54f3d3a16bfbbc4595b42131e8d7e25b11513bba84bfee78e92e69d5b68b965461a2b3c5c491c8954910edfa0ebde5986b3744f507162b8173
-
SSDEEP
24576:S0P6CuCyWuhDbQVyNozcQRpLgh7fDkbC+C6KT6XGIcvG:3ACRsbQVqozYh72Ch6ZXGI
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\06f135e5e78816588bc88d26bda4292e.exe"C:\Users\Admin\AppData\Local\Temp\06f135e5e78816588bc88d26bda4292e.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\06f135e5e78816588bc88d26bda4292e.exeC:\Users\Admin\AppData\Local\Temp\06f135e5e78816588bc88d26bda4292e.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
382KB
MD5d4475f18fd416a9d2317f821e60cae63
SHA1268f3b8970ddf62b0b0b6768f033b2dbb20ef434
SHA256c9b3dc8f4ebf0cf840eabb519430655c3654584e204624379a8feb02ff2881a2
SHA512740b9fcdeea4637bbbfa85aa1e962c28d1a827632755b7be4d5c9a03df934d5d93f230b5c7da1e01b26640fb2be6c570bd780c91b26abe64215bb84681a3f69c
-
Filesize
4.4MB
-
Filesize
1.9MB
-
Filesize
1.1MB
-
Filesize
4.4MB
-
Filesize
1.1MB
-
Filesize
4.4MB
-
Filesize
1.9MB
-
Filesize
1.9MB