Analysis
-
max time kernel
151s -
max time network
179s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
30/12/2023, 04:23
General
-
Target
0e5c66dc386a40c881e276c3011abad8.exe
-
Size
2.7MB
-
MD5
0e5c66dc386a40c881e276c3011abad8
-
SHA1
4d5d3bbea39d7e32e4de881fa5e320a847c2f364
-
SHA256
6b8919852d9593718a4020a2403e47801f38bc5604f1ba133bcfacc809723b05
-
SHA512
27f442de64441ef31b605f90ec88b1724930c88c15d185926f3a758e3445b09cb473cef8265117534f94e00b1ece88e89f98ce81b6a27f5d53b3a0e948da7f0e
-
SSDEEP
49152:LhVvY3U3dRLco8wxkas20qskXP5cUA8b/OWq6u2nepY8r3IhUKVkkd5TYGXGf:LvB3DLVQSP+rR6u2nepVRKVjUGXGf
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0e5c66dc386a40c881e276c3011abad8.exe"C:\Users\Admin\AppData\Local\Temp\0e5c66dc386a40c881e276c3011abad8.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\0e5c66dc386a40c881e276c3011abad8.exeC:\Users\Admin\AppData\Local\Temp\0e5c66dc386a40c881e276c3011abad8.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.1MB
MD5e0f49fe7378b440b68ec8d2d7a5a5e48
SHA18deac381d41877f2fc8f3843882cfafcb7c57915
SHA25627520592fc5f8f55e55755f5450e673ab6619db0802a733723a0abb060135398
SHA51228f7163bcb9c4a5666f44536d97c8749219717b586b18b975931f446c2ccc2e1b49c26a97c148ecdceb2297259c1d30ee71cf2eaf897fb8d086fe917b9601f69
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
4.9MB
-
Filesize
2.2MB
-
Filesize
1.2MB
-
Filesize
2.1MB
-
Filesize
2.2MB
-
Filesize
4.9MB