Analysis
-
max time kernel
149s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
29/12/2023, 20:09
General
-
Target
02a2ba4c8321fd36d5d22b20f4fcbfd2.exe
-
Size
5.8MB
-
MD5
02a2ba4c8321fd36d5d22b20f4fcbfd2
-
SHA1
194d071ba3eb9e1d568954fd0c9014c2a4db4c68
-
SHA256
caf4ce8ac1f76a077348d5533d6f9e0129756a0c766abc292f5c0dcfa040c53a
-
SHA512
5ec4a1ccf624298dda316a99841cc42bb7a0655440f64f7c0bf1cc111a0176dce427e72ba6a51a53c50df068cfd5a2503c74773e0b44c8ca68a72b421836508a
-
SSDEEP
98304:L7TgIIr7RICdvI2o7ugg3gnl/IVUs1jePsHjYrhRNm7yEzgg3gnl/IVUs1jePs:bgIItvo7agl/iBiPwakLpgl/iBiP
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\02a2ba4c8321fd36d5d22b20f4fcbfd2.exe"C:\Users\Admin\AppData\Local\Temp\02a2ba4c8321fd36d5d22b20f4fcbfd2.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\02a2ba4c8321fd36d5d22b20f4fcbfd2.exeC:\Users\Admin\AppData\Local\Temp\02a2ba4c8321fd36d5d22b20f4fcbfd2.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
298KB
MD50ae30b800782966b220a2dceaebff114
SHA1ea8b56fd6ddf9e540df3d40014e154b2264062fa
SHA256d993624daa559e53e866b4836febc22b54a98b7c749b9697e8292d75f9fee9fd
SHA512398e6df85a65b226b6f3c9cdb564d020e249ab1363480694c731e7e40244fdfd6f9e5cc24cf7f0b7e0781e054e30c4ced81865429fc7d8f8377e62f1a6de918b
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
2.1MB
-
Filesize
2.2MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB