Analysis
-
max time kernel
145s -
max time network
159s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
30/12/2023, 01:00
General
-
Target
095a80d2b654f39ff08b0a41050a3721.exe
-
Size
1.3MB
-
MD5
095a80d2b654f39ff08b0a41050a3721
-
SHA1
0b07591685cd29291eb155c267545884f83b22c1
-
SHA256
a7c52ab535f3a1906d7266cda03e3b010ada0a239980c45b334008bf5203acb9
-
SHA512
df5d331376ab23e19dbbd7340c83cb16e12ccd0d0b3e7c6bca3224124a70497f80b3a1e95845d375240d9115a2b186640233c6e8db35958a4481f364f123bf87
-
SSDEEP
24576:Aa8JAy1WIU1yR7Woy/kogMigpLJvGmcgIsk21JgTB+7irriZxoEvG:AvJANhyYbCutvG4IzHl+7iix
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\095a80d2b654f39ff08b0a41050a3721.exe"C:\Users\Admin\AppData\Local\Temp\095a80d2b654f39ff08b0a41050a3721.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\095a80d2b654f39ff08b0a41050a3721.exeC:\Users\Admin\AppData\Local\Temp\095a80d2b654f39ff08b0a41050a3721.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
679KB
MD54140fb84188dadc14002c1f8ebc00dce
SHA1037290205afeb86510fbade5d904f4a269c82b7d
SHA256c457f50977031425e7a5dbabfcd4be9b738e3378d5d2c89696a4c5a375ccfc70
SHA512b270f674cae0597f72437a36e8065a48aa568f3f9d55417cb0c20537917e55c00be4eb04cb06f8b554b11ddde407d177a534e0349f5d3b877453228c871d8e48
-
Filesize
4.4MB
-
Filesize
1.9MB
-
Filesize
1.1MB
-
Filesize
4.4MB
-
Filesize
4.4MB
-
Filesize
1.1MB
-
Filesize
1.9MB
-
Filesize
1.9MB