Analysis
-
max time kernel
149s -
max time network
80s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
29/12/2023, 20:38
General
-
Target
035ba4837bf9df3cb02ab60942704b27.exe
-
Size
9.1MB
-
MD5
035ba4837bf9df3cb02ab60942704b27
-
SHA1
e2e4527430dabcb2b316f9c2a84411e737655dbf
-
SHA256
20e11dc4046f6fd5e5013684e5663a37d3e0bc7da1895d81e3b27426f2c44eb8
-
SHA512
2ea4a74aa1e98f4365b0d3a5d79346ab717db76e5f6be21177a07a9e8be7c652785d546c81302448c6a04e1634f2e1ccd5341019c8368dc20d51993892fafda5
-
SSDEEP
196608:byM3DqJrSFLgl/iBYJa7QSVtzItgl/iB+B2mgl/iBYJa7QSVtzItgl/iB0:b5uJmFL2i+aUSm2ioX2i+aUSm2i0
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\035ba4837bf9df3cb02ab60942704b27.exe"C:\Users\Admin\AppData\Local\Temp\035ba4837bf9df3cb02ab60942704b27.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\035ba4837bf9df3cb02ab60942704b27.exeC:\Users\Admin\AppData\Local\Temp\035ba4837bf9df3cb02ab60942704b27.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
18KB
MD52896f6fb22e0972b3ebe6c6529baee6b
SHA18c515d58c161e1f97eba1b3e0f96b3c4bfe3141a
SHA256a2fecdd09db012a6880a8cd53c4ef3803342594ac469dabee5dd1010bee0d97a
SHA5125b03546413a357b57fa2fcb3a70b31d23e31ab8cb394a81ac3fb9b5f04f13d5a2be8d7d2734f4d8d78a8e2504f31b3b560184f5832bb098ac6327a045ca3c366
-
Filesize
4.9MB
-
Filesize
2.2MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
4.9MB
-
Filesize
2.2MB
-
Filesize
1.2MB
-
Filesize
2.1MB
-
Filesize
2.2MB
-
Filesize
4.9MB