Analysis
-
max time kernel
154s -
max time network
169s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
30-12-2023 04:16
General
-
Target
0e25ca2be8de8d937162c044ecb1b6da.exe
-
Size
1.5MB
-
MD5
0e25ca2be8de8d937162c044ecb1b6da
-
SHA1
2cb1b3eaf9547a3a6dc80bfdfd52abbcfc39900b
-
SHA256
2a35481e6304d89abc91a396547502fb107f39b46162815021cffec105c81022
-
SHA512
a79cc2bee0f40b43ce872bc9c6d2704913e77bceec8fa88e447d11c766323a94e3aa52478fa683fd21f28b63c4f159e5eb1ea2417420d709acae7d2aa939490c
-
SSDEEP
24576:x5CyIbYHpJKE7Yql5xa6CFDiGrMHaFeCS4uvQ+vFW:xYbg7Yql7axZXrMHoS4uY+vF
Score
7/10
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0e25ca2be8de8d937162c044ecb1b6da.exe"C:\Users\Admin\AppData\Local\Temp\0e25ca2be8de8d937162c044ecb1b6da.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\0e25ca2be8de8d937162c044ecb1b6da.exeC:\Users\Admin\AppData\Local\Temp\0e25ca2be8de8d937162c044ecb1b6da.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.1MB
-
Filesize
1.2MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
4.9MB
-
Filesize
2.2MB