Analysis
-
max time kernel
144s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
30/12/2023, 09:53
General
-
Target
150709bc70f0761e468047675d02a4cd.exe
-
Size
2.9MB
-
MD5
150709bc70f0761e468047675d02a4cd
-
SHA1
ea97167d27ad3f22a495bb9694abf759af60af40
-
SHA256
7938bdfc7fecda1336f11c479b5c66265dd22df659f341cf3a428019ab9324b1
-
SHA512
ac03508c5261d60a0e8f43d005887dd578032e30c108313d71535e37e7e77fec282cb5d1fb6ae8e2d35c49a148c3f40801a6b6e7d2c5ea98a0ef1ed766768a1b
-
SSDEEP
49152:MA+4zxv2OvGRJEieYu7v/nainzB9Baj8BBT4SfcsUjoh48TyMPkXdwkyZ:d+4zl2/01n1Hau42c1joCjMPkNwk6
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\150709bc70f0761e468047675d02a4cd.exe"C:\Users\Admin\AppData\Local\Temp\150709bc70f0761e468047675d02a4cd.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\150709bc70f0761e468047675d02a4cd.exeC:\Users\Admin\AppData\Local\Temp\150709bc70f0761e468047675d02a4cd.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
85KB
MD54bda0073e62f8808ade1b779c3fd5c99
SHA16cb56ff24f32a82372905c475a5d2d179fed9aaf
SHA256c68855cccd5f93d1f5558365dd05db327d0818b0ea1df998c905d6a80004fa2d
SHA512b5ec537732d76fe89c62b8f076ebf216e80adfb7b7ea06b63c9a7a49cdf64d89d3d3d58a725035d3b48ac4476e2c0919881c6b84d7ae1395f7f187974c6a5388
-
Filesize
4.9MB
-
Filesize
2.2MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
2.1MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB