Analysis
-
max time kernel
143s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
-
submitted
29/12/2023, 21:24
General
-
Target
0461a6bbb34ac95e2dd984da8a83ec1a.exe
-
Size
115KB
-
MD5
0461a6bbb34ac95e2dd984da8a83ec1a
-
SHA1
f36179a5f3007402e626a13a32211ef0bbed3399
-
SHA256
b4dae8d13304fb7ae3dfddd23865a8a73a69f549b422ef78a42c22f1b7b020e6
-
SHA512
856bde16443a26d0b340c022ee744a9db200d8ecdd0bc13bfe4e306180eb473144eec9ce97d702b368ee63362f2dc0028caea075c02c8aae21229dba5d856278
-
SSDEEP
3072:S2tamANMAPjXWVhjn822XbQTiEhJHcSTMHGBdmh:S2amqMMk9Jm0Tz5caZ
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0461a6bbb34ac95e2dd984da8a83ec1a.exe"C:\Users\Admin\AppData\Local\Temp\0461a6bbb34ac95e2dd984da8a83ec1a.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\0461a6bbb34ac95e2dd984da8a83ec1a.exeC:\Users\Admin\AppData\Local\Temp\0461a6bbb34ac95e2dd984da8a83ec1a.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
115KB
MD5f0c75310ecc92779d4a7a96e08ff6dea
SHA168f974c073003bccc22de6309038ec66ac4e2a8a
SHA256aecab7881f90777511116db2ca99c9f38cd045bfc028ce092abe4b07c7665a78
SHA5123fd51b3156fa5dcd57037bcb07a49b658dff24a7cde69587a8ed3a4b664083b44d8e3b4e58cbc0936fa0fa38d487e48555ce949c18ab07fb68f19805660ea311
-
Filesize
468KB
-
Filesize
116KB
-
Filesize
56KB
-
Filesize
116KB
-
Filesize
468KB
-
Filesize
468KB
-
Filesize
116KB
-
Filesize
116KB
-
Filesize
116KB