Analysis
-
max time kernel
161s -
max time network
174s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
30-12-2023 01:38
General
-
Target
0a57f3243f06a6779e2cb7192336242e.exe
-
Size
2.7MB
-
MD5
0a57f3243f06a6779e2cb7192336242e
-
SHA1
e5ee8133435c6b869052d6732d6630628d1c6aa7
-
SHA256
0b4f7be7a99ad0ffb47a60ddbfb95ee39c929445ab105c5b8b4a1097c09fc2ad
-
SHA512
639480a56f8b899ed906670547eb22870e0c578538ed9b421ed20dc13aa5fe722acf055b42e93e462d9a8c11576b38cf66f297e5271699c7625f7ffb544884d9
-
SSDEEP
49152:bSfzrw2K/MJparPUP+fEqxVJOh65MnREsdnR9rZ2NH7bpNAZ6Iosr4MOUKQqumTL:bigfmpM8Py7YRnusdnHdmH7b269srXOf
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0a57f3243f06a6779e2cb7192336242e.exe"C:\Users\Admin\AppData\Local\Temp\0a57f3243f06a6779e2cb7192336242e.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\0a57f3243f06a6779e2cb7192336242e.exeC:\Users\Admin\AppData\Local\Temp\0a57f3243f06a6779e2cb7192336242e.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.3MB
MD5d9b267662b5a584850450480a1405a45
SHA19c8699a2acb1a362b5dfdf1b64fd37e949aa1788
SHA256c1a39ecd19dfe5b31f2539c48e2791ae382dd5096e43a9f03ed42d48db80e397
SHA512dfece0e75ffe43da0dbdd246ea0397c38a6f6c4c5089cf8bee355d96638bc50992767b4e49de41425729d825ebd06575500c61922458a5d78509c8934c85a72d
-
Filesize
4.9MB
-
Filesize
2.1MB
-
Filesize
1.2MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
2.1MB
-
Filesize
2.1MB