Analysis
-
max time kernel
142s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
30-12-2023 09:28
General
-
Target
1483b82426a1600b46440197bfa29750.exe
-
Size
2.9MB
-
MD5
1483b82426a1600b46440197bfa29750
-
SHA1
56231bb28de774d80fedf654f40ff1ff09bc5786
-
SHA256
d14b8c0645e5a7ad1d471d526038f871691c297068e8eb4d66e8a89229516d74
-
SHA512
2568e03827c3239166313c02e90a42c6eed4da99b5adfea43c55c5f15218819a9258ae84c173c1a7b48fefcd172829a9462a1551991cc22f9c7f1eeae6059cd2
-
SSDEEP
49152:e2LiRGJfNgOJjEk7dOGskAaPP4M338dB2IBlGuuDVUsdxxjeQZwxPYRKs:e2LhfaOJyMAaPgg3gnl/IVUs1jePs
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1483b82426a1600b46440197bfa29750.exe"C:\Users\Admin\AppData\Local\Temp\1483b82426a1600b46440197bfa29750.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1483b82426a1600b46440197bfa29750.exeC:\Users\Admin\AppData\Local\Temp\1483b82426a1600b46440197bfa29750.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
286KB
MD5c2b320078881415523d30be603ab04fd
SHA1c4bcabf6651136adfc8a88906988575e5cd9e2c4
SHA2564e163a8eb3d77324da026c7459e724323d9c5d27bc5fbc9270d28bb83e4d88a9
SHA5123a4e948f2bb7eb5a40db5e24c3ae6ab8c9c51909bdec3fe36907948c639b424316f02953856f6129947fe24eb89761213cf7f7dd3bf82ea8f7019d11643efdc5
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.1MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB