Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
29-12-2023 18:23
General
-
Target
0055e30c0adbcca8bccb6a9f679b4d66.exe
-
Size
1.3MB
-
MD5
0055e30c0adbcca8bccb6a9f679b4d66
-
SHA1
681c4b5059414c67dc259439bfe990b8eb90e4ce
-
SHA256
69994a9da037da4248ba1a3be10d40f95671a7d6499b4cbee2f8343ffa2f4142
-
SHA512
b281449b7822c48e9b4db64792167ae787b2ec60104804656770f967cf2bf67665e552f4db7149cc0efef633ba362e8835a877c1ed96e2b2f6771831de546ab0
-
SSDEEP
24576:N9X5efJmYo9NzwNiEJjyBIgBOUK4uUY38Uq8/FlRg25BLvG:NV3PiiNIgBNK4HY38olRg2z
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0055e30c0adbcca8bccb6a9f679b4d66.exe"C:\Users\Admin\AppData\Local\Temp\0055e30c0adbcca8bccb6a9f679b4d66.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\0055e30c0adbcca8bccb6a9f679b4d66.exeC:\Users\Admin\AppData\Local\Temp\0055e30c0adbcca8bccb6a9f679b4d66.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
576KB
MD5750ea9d42b175deba385204a079e6a17
SHA11a091c26c586fbdc8cab03e24320b4897996a734
SHA256cc1a83167d8705c2cb3b6752a3102390f90941a7e86672f111fe5044253a200e
SHA512f1be8f87e7c8e15ab8a63e08790e8c1fa476921975a73ca83758f02c5bd82709459d8695dd365b310dd1bb4b68d555856c6513a26891cdba2aa25ef0a5da7ee5
-
Filesize
1.1MB
-
Filesize
4.4MB
-
Filesize
1.9MB
-
Filesize
4.4MB
-
Filesize
4.4MB
-
Filesize
1.1MB
-
Filesize
1.9MB
-
Filesize
1.9MB