Analysis
-
max time kernel
166s -
max time network
194s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
30/12/2023, 21:47
General
-
Target
1d8521e2ef3d804ecd8d08d23cd33632.exe
-
Size
1.3MB
-
MD5
1d8521e2ef3d804ecd8d08d23cd33632
-
SHA1
e8701a84549c3bce35a72b8d8e39c8b7ee0a2b73
-
SHA256
4a15c26479abe69fb79ff61919759acd1ff41019899c685c6860e587f8bca7c6
-
SHA512
67629ef84be20c9adea35e0f27387c01cab5bff34f05fd7639b465c6425fa89bef55aaf44721fb0d8da1ce20d5a008b9595ed27cedce3ee823209104ad70affa
-
SSDEEP
24576:Xtslfg5H77Zs2V6QZsbWFRWmlK1YvMenGSNyjm/fZASASVPCtnYvBmnU9/9Us:9sfg5H77162sAK1Yv/wS5CtYJmUR9j
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1d8521e2ef3d804ecd8d08d23cd33632.exe"C:\Users\Admin\AppData\Local\Temp\1d8521e2ef3d804ecd8d08d23cd33632.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1d8521e2ef3d804ecd8d08d23cd33632.exeC:\Users\Admin\AppData\Local\Temp\1d8521e2ef3d804ecd8d08d23cd33632.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
585KB
MD52b9304cd9213e8d716e2c80decdcd3ed
SHA127b1ff4a70076a7cb842fe91ea82f1f7227978a6
SHA2563e9d0bc65f6f297d68311b8116255a8a1de70441a5878b6a5bc0edd3c9f4965e
SHA512a0dd8d7f997451757382ca69b6497c62ca012fbccbd4ec4347aa60f174b7e8af0710f0871702a44c400873cd2750f426fdaec8d94e3f24046e325c0a99c19504
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
4.9MB