Analysis
-
max time kernel
180s -
max time network
182s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
30/12/2023, 01:59
General
-
Target
0aea37d0fdc65bccf7b0e13710dee246.exe
-
Size
1.6MB
-
MD5
0aea37d0fdc65bccf7b0e13710dee246
-
SHA1
70a5a7b39c9a281716617958388ae8043625ffbb
-
SHA256
84b2a006d0aee5cdf8e4fdb4952c72ca57fd6a9f2840b5c72e806896270667c6
-
SHA512
6211dfbb8fa2fd0b46bd189375fe69aecd82683f1d6d0a4c49bbb57f6357f80d3efec2fb718f73e3e5b0768b68f83bb5f5264b0b5e14ab0d4783a4bf945ee009
-
SSDEEP
24576:atMl5unlvZCGp94SPMiSvWERjD9liyaOvaP+h3J9xC1viWI0td:eFZsSk0nhOvaPe3HYgP4d
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0aea37d0fdc65bccf7b0e13710dee246.exe"C:\Users\Admin\AppData\Local\Temp\0aea37d0fdc65bccf7b0e13710dee246.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\0aea37d0fdc65bccf7b0e13710dee246.exeC:\Users\Admin\AppData\Local\Temp\0aea37d0fdc65bccf7b0e13710dee246.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
172KB
MD5eea49cfe8dc5914c64774f6d3a72fabc
SHA191c8beb8213f12a42df03c0633f3b2b42850845f
SHA25624c8cf5b8845e8f8915a566434f92ff38df5f6be1292cea0cff44d5307f692e7
SHA512dbb79a774611d4bf9ba06500b066d8cf94eaa239cae53dc851a36edf75367dabc4c738da25e09b3229612777b3b2a2dbbd1a07d85c209225ac91f2c2b44e8612
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.1MB
-
Filesize
4.9MB