Analysis
-
max time kernel
151s -
max time network
162s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
30/12/2023, 01:55
General
-
Target
0ad2e75ac2a8d43de24dfe9cbc037e01.exe
-
Size
1.5MB
-
MD5
0ad2e75ac2a8d43de24dfe9cbc037e01
-
SHA1
513604e38a7e7f5eaf3202d30888a55e82510ef8
-
SHA256
24b62d7d1736b0516984a0fb846673613004892bc0de96693ad31c2c1dadf43b
-
SHA512
acb1200852bc45f6ffce7c653604faac8c139a3dca51fd85b0f5afbf8eb8d6dacd71c817e4fe4f7cce0f1978557231e64f883091173f09c91f96f2435e5f2389
-
SSDEEP
24576:8R+ozmP5iTyqgzxq7Xd7vdhuUvFtD7Tktu4XnNFeDvRWzEnNP1vliTW:8MPRiTb6aZvfB/k043NFejJNNvQT
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0ad2e75ac2a8d43de24dfe9cbc037e01.exe"C:\Users\Admin\AppData\Local\Temp\0ad2e75ac2a8d43de24dfe9cbc037e01.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\0ad2e75ac2a8d43de24dfe9cbc037e01.exeC:\Users\Admin\AppData\Local\Temp\0ad2e75ac2a8d43de24dfe9cbc037e01.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
72KB
MD5b7a480e0170377a3b333a67b34f9c47d
SHA1e7a10d59d6f1e3dc33ba59e25d0d7fa3b981f787
SHA256c200363077d7fdf3382915e82b6dcd9658348bf9ffd02d837b56b220279993a6
SHA512d09da63b642a4c6af3586c03c6d8bc543fc8871d4d34f25dabc1650ec047c652db7d62bf1def067b24fb2e7e21e6907c797b2cf0fd7a64f7a86d5055cc80794a
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
2.1MB
-
Filesize
2.2MB
-
Filesize
4.9MB