Analysis
-
max time kernel
205s -
max time network
219s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
30/12/2023, 03:00
General
-
Target
0c5e458220d4511d4354babff812ad99.exe
-
Size
1.3MB
-
MD5
0c5e458220d4511d4354babff812ad99
-
SHA1
241930fcfe0b76e1943c309bb14cf0a48c45bb91
-
SHA256
98be4baa411b9a1235f5d4f27b2ca8808ce50f4a119af02a5e4b4ec299de597e
-
SHA512
434b5eebb9a113a1a861c41af33f435641c33ebb2f65663567ec69e7323c75859061a9e897c37d87df6d692c55983888c8482f64ce92e541b3fc8ba9003da996
-
SSDEEP
24576:T2+KJlxfiBYhT7UsDjHn13qq7B3AKtG+5CJJT2khW3nDw21C1SawpWCxF+LlWc:i+euBUIW3HlQKILPqQW3PCwBb+Llp
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0c5e458220d4511d4354babff812ad99.exe"C:\Users\Admin\AppData\Local\Temp\0c5e458220d4511d4354babff812ad99.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\0c5e458220d4511d4354babff812ad99.exeC:\Users\Admin\AppData\Local\Temp\0c5e458220d4511d4354babff812ad99.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
849KB
MD5a22fb1335a04d86aced3e3301309abe5
SHA1f4313adb8c5c8b7927b2bf34fc249307d1e2e6be
SHA25684084ef386b365d286ceb493acee128a1531cf70351cdf47b413532deabd5798
SHA512d1afd42dd5ae0c96f648a59213a3e4ebfdbf671cd62ae29cd2d794d25a22c90da258fc0df52405ea7bb117c7b0f0d25b4b0f0dcc265d7010a622c6a7bc1fb883
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
4.9MB
-
Filesize
2.2MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
2.1MB
-
Filesize
4.9MB