Analysis

  • max time kernel
    146s
  • max time network
    112s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30-12-2023 00:54

General

  • Target

    092d154bc4b4d341c694cfd337695b6a.exe

  • Size

    82KB

  • MD5

    092d154bc4b4d341c694cfd337695b6a

  • SHA1

    581bb3acd97773de8ef4a0bcb3f3658e4fa9d862

  • SHA256

    a660bae0dea1a47cfb99923e4b7ba94089ba501e260ae23177819ad80c1e0aaa

  • SHA512

    a140dc292d02b2f111dc724bce2ec2fe24d41eeafbabaaac7526fdc3b6e51651685fcc5ecfc978bbd7486141085c0e1907cb74a22ff34e6fe66eb4daa55c4dd4

  • SSDEEP

    1536:OuuxdBl8fvpSyEK0wDzMM7udY1ywnD+FJFWnowTVmzFED9tVsBAkWrPRbJ:Ou0XUCKgbY1zD+FnWoAmZEjVs2vPb

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\092d154bc4b4d341c694cfd337695b6a.exe
    "C:\Users\Admin\AppData\Local\Temp\092d154bc4b4d341c694cfd337695b6a.exe"
    1⤵
    • Suspicious behavior: RenamesItself
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:4360
    • C:\Users\Admin\AppData\Local\Temp\092d154bc4b4d341c694cfd337695b6a.exe
      C:\Users\Admin\AppData\Local\Temp\092d154bc4b4d341c694cfd337695b6a.exe
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Suspicious use of UnmapMainImage
      PID:4836

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/4360-0-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

  • memory/4360-1-0x00000000001D0000-0x00000000001FF000-memory.dmp

    Filesize

    188KB

  • memory/4360-2-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

  • memory/4360-11-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

  • memory/4836-25-0x0000000004D90000-0x0000000004DAB000-memory.dmp

    Filesize

    108KB

  • memory/4836-20-0x0000000000400000-0x000000000040E000-memory.dmp

    Filesize

    56KB

  • memory/4836-14-0x0000000001500000-0x000000000152F000-memory.dmp

    Filesize

    188KB

  • memory/4836-13-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB