Analysis
-
max time kernel
161s -
max time network
172s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
30-12-2023 02:34
General
-
Target
0bcfc8363b17d7550c405ca130a4f406.exe
-
Size
115KB
-
MD5
0bcfc8363b17d7550c405ca130a4f406
-
SHA1
a96bb63d4a6e23bc110e54f0322d5f71f4339763
-
SHA256
60b053573d2913128afcf486f93975d615322afd0090e9dfc30ea7a945fcbe05
-
SHA512
784d079dcdecee8bfcd5514b85b18e122d01ba17294d002b17d9d77fd5fafdc16ea71f03c7a1124290b39ef390d376e17ba2f2efc4611ff94b0ed6c27c6786d8
-
SSDEEP
3072:sxe3OXU/YBI0ivxFNjM0eL2LOPQAXraD:2U8IVvxFNjTOm
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0bcfc8363b17d7550c405ca130a4f406.exe"C:\Users\Admin\AppData\Local\Temp\0bcfc8363b17d7550c405ca130a4f406.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\0bcfc8363b17d7550c405ca130a4f406.exeC:\Users\Admin\AppData\Local\Temp\0bcfc8363b17d7550c405ca130a4f406.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD5f227c75b09f1f49c4d10043b67a268be
SHA18047d34f972f5292aef20601d720e7d4009a2426
SHA25606f8905aac5ebcfdb7b6ab73d09918d5a7b7f20645bbdc624c575c7d58c8c8c9
SHA51243cb9cf84fe4c5900c12b5527f4a308047f98650cd3b070e3fbffcae83afa5694faf852e5d6658efcfd02335b7cb6b341769f3d4fd583ac09d888b42ef2e6b7c
-
Filesize
468KB
-
Filesize
116KB
-
Filesize
116KB
-
Filesize
116KB
-
Filesize
468KB
-
Filesize
116KB
-
Filesize
56KB
-
Filesize
116KB
-
Filesize
468KB