Analysis
-
max time kernel
144s -
max time network
179s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
30-12-2023 00:33
General
-
Target
08add932c5ce1ce7d49f13143b84e7a5.exe
-
Size
1.3MB
-
MD5
08add932c5ce1ce7d49f13143b84e7a5
-
SHA1
144e192e429deaa12d670e095466136808f907ed
-
SHA256
ccb541df992dfefa68921b5226ac5b52d7c2953e58e359224d02b3c3e2340f89
-
SHA512
2a5d3c95ddd70924c20b971a2a13d151f8b958f4d362ef32d8d66387b1b90e29545d1b4f95edc18f6c71b6524015feede8896b2e61350466a12cf6c70666282e
-
SSDEEP
24576:TxxoGEzRjGLmib0tzd9ZdrYEfjr72QydIy9L8upUMq9iZoRxnx2BTFdvWO:TwGEzRqL1bGTdlff72QCIyZ8DX9iGRnY
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\08add932c5ce1ce7d49f13143b84e7a5.exe"C:\Users\Admin\AppData\Local\Temp\08add932c5ce1ce7d49f13143b84e7a5.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\08add932c5ce1ce7d49f13143b84e7a5.exeC:\Users\Admin\AppData\Local\Temp\08add932c5ce1ce7d49f13143b84e7a5.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.3MB
MD538b06b7d3a7fdcc0d03e622a6292d8a0
SHA199a87d5f989fbfdacbee9c25eac0d785e3334772
SHA25673106a9979cd220b725100c950cf77231705da5dc7f39479a92340da5363554f
SHA512c9d2d388d6d2fc816d093d77558faf76b625d113c4e0497ec73fb743218f1b9062d01dd56cfe98e398129e31e8e84ce851562a3c22f3ce6312e8da12bde00ed1
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.1MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB