Analysis
-
max time kernel
151s -
max time network
174s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
30/12/2023, 23:42
General
-
Target
2065b8647d62c3963d7104773b85de86.exe
-
Size
5.8MB
-
MD5
2065b8647d62c3963d7104773b85de86
-
SHA1
850236a06177b81081a32dade04d9abce11d44dc
-
SHA256
f68c59c92102c7d5c6f6296680a42da562c2b241243efa0a0b74d0492b8a8363
-
SHA512
a0d17adfe94fb991992958c710de8f079fd4da1c0e91672c8b554ed33a1be13b27eb14ce37cacd8085055d1bcc787196ab1979d90ae2ebd0f992396114e6f57e
-
SSDEEP
98304:mz68VGA0L3z6Hau42c1joCjMPkNwk6alDAqD7z3uboHau42c1joCjMPkNwk6:mz6U0Qauq1jI86FA7y2auq1jI86
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2065b8647d62c3963d7104773b85de86.exe"C:\Users\Admin\AppData\Local\Temp\2065b8647d62c3963d7104773b85de86.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2065b8647d62c3963d7104773b85de86.exeC:\Users\Admin\AppData\Local\Temp\2065b8647d62c3963d7104773b85de86.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.9MB
MD5dd4c559c7a97271857163d620a767b72
SHA1b5f12bb2442b2ab75435e4fcd62c858b10ac2b42
SHA25674714b6bb7ff1ed379410dfb9cd3df2b66f2d27ed5b67d0614a9e0d6069eb675
SHA5123f5c29590ed96a57ca970de4bffafbc88550009451a661b68e9e2acf1f8e55c862b9c5b3f1c02eca31d320d4a33cd33787c550edceb29f3f121dd01edd5e80a7
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.1MB
-
Filesize
4.9MB
-
Filesize
2.2MB
-
Filesize
1.2MB
-
Filesize
4.9MB
-
Filesize
2.2MB