Analysis
-
max time kernel
149s -
max time network
170s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
30/12/2023, 03:42
General
-
Target
0d4d174a48ccffc6c4478465951b36b8.exe
-
Size
5.8MB
-
MD5
0d4d174a48ccffc6c4478465951b36b8
-
SHA1
9bcfcbfcc54b6cf490ae425630d06e265c71bfef
-
SHA256
24bcbc364a27cb6da85ce7dbc52f8bcc4e499640c22b8f422c320a293dba103b
-
SHA512
66027a5b0f2dd9efe397e5ca19a48182f2546ce098f6e56133482c2027d60b6c093d377a1ddcccbe267b329aa747cc2dcaea1773e097272f511db9c6fddd925f
-
SSDEEP
98304:hJ+5qxTcLgdKA9GQZaXhP5a9UEI+eG9jAkbkR79D+cVItGQZaXhP5a9UEI+eG:hJ+5qx62GhRaaCkN9qHGhRa
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0d4d174a48ccffc6c4478465951b36b8.exe"C:\Users\Admin\AppData\Local\Temp\0d4d174a48ccffc6c4478465951b36b8.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\0d4d174a48ccffc6c4478465951b36b8.exeC:\Users\Admin\AppData\Local\Temp\0d4d174a48ccffc6c4478465951b36b8.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.8MB
MD59341a23b8ed8d885f5d82fb8bf9c160f
SHA1a6136585670a7e71704f9fafb7eb768b6b027431
SHA25642a7d2349088f9cc614c7d7d0c62e92fae7cb8182ee7a8517fea872633c375b7
SHA512d39f75c20d99619542a6cf7ba1df9699f00a60a355f05458da016e4408638acebc46313d044be982c761e90f884a4055fd388602ba1c4594dfe3af9198fa6c59
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
4.9MB
-
Filesize
2.2MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
2.1MB
-
Filesize
4.9MB