Analysis
-
max time kernel
166s -
max time network
192s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
30/12/2023, 23:16
General
-
Target
1fb47bccf43b6bf050159bebc32257a6.exe
-
Size
10.6MB
-
MD5
1fb47bccf43b6bf050159bebc32257a6
-
SHA1
00168250b5241cb05b3a4f35355da4e9a891f4bc
-
SHA256
eaa47b7774677b023ae0a53afd136fb9e3b39d60d68649db0d59f8e599d613c9
-
SHA512
690f5e640919aafd9731f733fb49141255992ccdd29259f66c3c8105afbb0d3c46eb0b080d2ae173cf038b271683d9b21be78be1b322e0c6e9c2cee8160e4e1c
-
SSDEEP
196608:lBC1Wk2qGtyB/rnCeKaRz+wnXGtyB/rnC1tzBxbnBGtyB/rnCeKaRz+wnXGtyB/Y:HOWaGtyB/r3TRnGtyB/rwtzXBGtyB/rS
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1fb47bccf43b6bf050159bebc32257a6.exe"C:\Users\Admin\AppData\Local\Temp\1fb47bccf43b6bf050159bebc32257a6.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1fb47bccf43b6bf050159bebc32257a6.exeC:\Users\Admin\AppData\Local\Temp\1fb47bccf43b6bf050159bebc32257a6.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
834KB
MD5d707cb259afbb385a417dbe7333623c9
SHA1b4436fb641ea2671d19ffa53bf59a54ed488eb9d
SHA2566fe7cf8dcc0476a5f7321b576a50a1d3a914c65422f0095e5b1df7ffd61ecea3
SHA5124c65f7a4ed943783d36c2d63b6a1752a9800225594923708bdadeed2306366c09e0c06c9af4d95aeb127c129ae390eba6b0c51d5e3ac662ef5f62efa55fd820f
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.1MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB