Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
30/12/2023, 08:00
General
-
Target
12dbdb822faa7eaeb5c9c1a4173fbcc5.exe
-
Size
5.3MB
-
MD5
12dbdb822faa7eaeb5c9c1a4173fbcc5
-
SHA1
8b91fc29ccad79af7fd9d883a5671de47880b3c4
-
SHA256
87b53135d1c58c855b4806adc63619fb495f53b22566e27bd5a5855b6f8da496
-
SHA512
41ba4f16e5c62aaeabf29a84c2475f7ca7a205838a0e3d222c919ceb82e799b513b7ff16543db4e09563f07393d28e53a716415359f35a988eab6fcedbde04b2
-
SSDEEP
98304:fTLNpAqhvbH4mk7vTbIvHXLfLReit+vH4mk7vTbIvHj:gqhTYmGXm3LfN2YmGXmD
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\12dbdb822faa7eaeb5c9c1a4173fbcc5.exe"C:\Users\Admin\AppData\Local\Temp\12dbdb822faa7eaeb5c9c1a4173fbcc5.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\12dbdb822faa7eaeb5c9c1a4173fbcc5.exeC:\Users\Admin\AppData\Local\Temp\12dbdb822faa7eaeb5c9c1a4173fbcc5.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
381KB
MD59ad4be4bf12f8b1a92aa68aee5f3fa48
SHA15f591af1fa787d228b58f92cae7727efa6e41d90
SHA2560aae0f5c1d44e8eb91ecb33da6208199ffd3ae0f4724247bcdbaa66363119320
SHA5124d5f2a05f8ae38062289dcccc24a6c20d0121fbe76a75328ea0b554ea76c6e03c7bdc43d25a1bd3a2e43580bac1ffd3d8191ea20afbccde3e897388d8f6e17f9
-
Filesize
4.9MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
1.2MB
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
2.1MB
-
Filesize
4.9MB
-
Filesize
2.1MB