Analysis
-
max time kernel
150s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
30/12/2023, 01:41
General
-
Target
0a693fb01c806c779de3c9d49617f128.exe
-
Size
82KB
-
MD5
0a693fb01c806c779de3c9d49617f128
-
SHA1
49f5e697774382e695bfb416ad4b529bdf86ac1e
-
SHA256
6d933972b8945c2990934161b9632773d566ce613be9407a92eeee29caa606e7
-
SHA512
39b6aa89e0589a5cd07f7137ad440b239a1a9ec4432298a08168125d6d018e749969777b10542e1dd95f3806bb0e12506eedf2bb42976a1af2b385b18921fd68
-
SSDEEP
1536:TkDOCLrgj8QJ5RUvhkajPPf/fc88zQi1yEH3LK6vT5pZJ/O2TVmztHLmvsak0X18:8fQbRUvhkajPPf/fc8mH7K6vT5pZJW2u
Score
7/10
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0a693fb01c806c779de3c9d49617f128.exe"C:\Users\Admin\AppData\Local\Temp\0a693fb01c806c779de3c9d49617f128.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\0a693fb01c806c779de3c9d49617f128.exeC:\Users\Admin\AppData\Local\Temp\0a693fb01c806c779de3c9d49617f128.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
82KB
MD537739499c58b57bf5e2db409e24de36a
SHA15e63462e868be6efcaaeca932d52fd23b7e9732f
SHA2567bab270db2c238ddb22597ab76de3f1ece07721e7787f8e760729ba196dd2047
SHA51220403aec2aa39edb87f97e33f45c7f2bc16f6c85922c5ffbe9756dc6f216fb8c3f9585bcc5ff4af87fc3533669530137f9bed10f0f69b0a4012ca613ec989704
-
Filesize
188KB
-
Filesize
188KB
-
Filesize
108KB
-
Filesize
108KB
-
Filesize
188KB
-
Filesize
188KB
-
Filesize
56KB
-
Filesize
108KB