Analysis
-
max time kernel
138s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
30/12/2023, 03:11
General
-
Target
0c943933f3cd3c86eb025f14bbb3fb49.exe
-
Size
2.7MB
-
MD5
0c943933f3cd3c86eb025f14bbb3fb49
-
SHA1
232ecb2d61796df290eef5a8b19ae4387c4198bc
-
SHA256
74c51b687baa37d3511017feb150f92def20aa47430f8d95ad4c4c5ad8537165
-
SHA512
3c11564b4869ec5793663a73ef98e79ca7e1e42d03ad71bec89b5d90d24e5321d3ee58e8a38989185c9edf09257a414fded9a0f6d815910aec7431c9c464a572
-
SSDEEP
49152:J6m/BdS7fUlqGvfJhmEZR9ktBc1+Q4YdxSChG38bDUggR9t:1/BEfUlrvBhLZHktBcwQDM2YIDULHt
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0c943933f3cd3c86eb025f14bbb3fb49.exe"C:\Users\Admin\AppData\Local\Temp\0c943933f3cd3c86eb025f14bbb3fb49.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\0c943933f3cd3c86eb025f14bbb3fb49.exeC:\Users\Admin\AppData\Local\Temp\0c943933f3cd3c86eb025f14bbb3fb49.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
146KB
MD51c93e2c0d30ea029df18fa170be4c4fa
SHA15300396ec841ad3476076462734ce207332839f7
SHA25661f5ec7d858510c580a64cc1cf269fdf081ab9cf230273ec3f587f249587cd84
SHA512a5e97df6ec4d6da22cae58242b0e232b2d646456b4c191b0168a271183957e590da20129646b180a78850bd3f1155817924e4e367f57da1c7965699c544e55d7
-
Filesize
4.9MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
1.2MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
2.1MB
-
Filesize
2.1MB