Analysis
-
max time kernel
157s -
max time network
172s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
30-12-2023 09:23
General
-
Target
1462c4229ac1afc307b271c7a97fdb43.exe
-
Size
1.3MB
-
MD5
1462c4229ac1afc307b271c7a97fdb43
-
SHA1
1f15b0944ffaf67e1065940d6ec81fed9a686e51
-
SHA256
c837ca37f826b09a45b199c820da9260ab65018210a512c3abea2b5dba2c09be
-
SHA512
351b5a35f6e4ad0608ef868e4e753cc8c9dffc276992d8b30af0c438a3a940f5bbb95c8da09158d1810558b9cf6bd1c36127aab2ed7ea25346ea7ebf9ba4363a
-
SSDEEP
24576:F0Ni4rtiC+kOFiJ7SG2VmTx6P5PHOF3GMQD+nEWRbjiVahmWMQrJYKvCs1NOwPw8:FzC0iJ7SOcPpmGPanhiVaDlzqs18awUD
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1462c4229ac1afc307b271c7a97fdb43.exe"C:\Users\Admin\AppData\Local\Temp\1462c4229ac1afc307b271c7a97fdb43.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1462c4229ac1afc307b271c7a97fdb43.exeC:\Users\Admin\AppData\Local\Temp\1462c4229ac1afc307b271c7a97fdb43.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
35KB
MD5da9651cf06dbbf222752cb5a5b608093
SHA1dd54c89e55e1ef0635f79660c3c4ad1fabe1ddea
SHA256843e0cfd3abbb57aa677663ea0ef86c3fc442a8a9f6262de72d185e76e9861bc
SHA512180b447c51d99c28270b6dc9e2a4fe1b1c517b8a5b5742d6038fa1afea3951ab48cc539f9864f0635f51d5818d974d2a380fff54841c4851677b31af77ff61c5
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
2.1MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
4.9MB