Analysis
-
max time kernel
192s -
max time network
218s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
29-12-2023 19:57
General
-
Target
026c8b3ca9f6fa84f7c38dca706c2366.exe
-
Size
1.3MB
-
MD5
026c8b3ca9f6fa84f7c38dca706c2366
-
SHA1
e975304605c31d1a7003f5cc46d3cb88786c7da5
-
SHA256
5f2da5e7e86cb023afbfdabf84ca7eac61c90debb6ec22f527dbf4d30dfe7042
-
SHA512
caa5fa71776592f77a7b2cfdc298eec5b621cc0cbfa620b20e180de79b6e8dc81ea33a96d5d5bd84e25dc8e4add97d5e0d3561435f4f2b1955c1a8fca0054029
-
SSDEEP
24576:pxcW7lQEcqu2pv+hja0yEOrOcc2/FUd3JIsagKxeLI+ajGz6QpBSKjbZtTBLvG:pFcqu2pv+hTCOd2/FUd5ItgMeLI+Qeu4
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\026c8b3ca9f6fa84f7c38dca706c2366.exe"C:\Users\Admin\AppData\Local\Temp\026c8b3ca9f6fa84f7c38dca706c2366.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\026c8b3ca9f6fa84f7c38dca706c2366.exeC:\Users\Admin\AppData\Local\Temp\026c8b3ca9f6fa84f7c38dca706c2366.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.3MB
MD59d3bbe2093c56dea7935d66a38d430fc
SHA1e36169e5423dc3f0355da686939bf12478e2e3a0
SHA256473e26cef09fb5a24f73033b3a71e96e2a5b544f1f025294928b23f6bd8ec34c
SHA5128ab9a8e250036dcc103b526dd2778f51b2ecf73167e37dbb2f050110770ef439679791955bfc29809ac03cc381d3ee7fbe8e73124b5b877bf359d4647fed6ff7
-
Filesize
4.4MB
-
Filesize
1.9MB
-
Filesize
1.1MB
-
Filesize
4.4MB
-
Filesize
4.4MB
-
Filesize
1.1MB
-
Filesize
1.9MB
-
Filesize
1.9MB