Analysis
-
max time kernel
211s -
max time network
224s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
30-12-2023 10:09
General
-
Target
156f3d68edf08421331837fa2d151059.exe
-
Size
11.7MB
-
MD5
156f3d68edf08421331837fa2d151059
-
SHA1
5a7b725292089104210c924df6f92fe424311134
-
SHA256
61fdc24a9f0639c81680ba3039ffadc38b9fe725b3ba9d7eaee17332d4b08265
-
SHA512
36ad7ff101aa4b4db95eb3f24a9da4e8cea36ef7665ea5c4636590723552ac9e2d891aa8c5b1e9f0bf0475a5ae690fb8c9a0d354e9941f7a88bcb3f4e179f2fe
-
SSDEEP
196608:JdT8sWCIW627WdWCxRVTN0pWCIW627WdWC:P1mWN7WdNVTNSmWN7Wd
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\156f3d68edf08421331837fa2d151059.exe"C:\Users\Admin\AppData\Local\Temp\156f3d68edf08421331837fa2d151059.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\156f3d68edf08421331837fa2d151059.exeC:\Users\Admin\AppData\Local\Temp\156f3d68edf08421331837fa2d151059.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.3MB
MD57c7d01b64771a729312dc0384b29318a
SHA15a357c48ac45f55e122696685d202276f257d2b1
SHA256adf74a436960f541a0f7c4171bda5af907130220f9d555f83e97a8b233475323
SHA51203a0d7f94fe2a63ced03e68ea88b3eff235ab08ac6da58eb175cb0852353a43d5c7b51f9292d42a24ab3c34e8812243ccf4cd4ff38b82d8d762c7e9c35250bbe
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.1MB
-
Filesize
4.9MB