Analysis
-
max time kernel
131s -
max time network
187s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
30/12/2023, 10:20
General
-
Target
15b7efe40667a8da268f02054732cd9b.exe
-
Size
56KB
-
MD5
15b7efe40667a8da268f02054732cd9b
-
SHA1
de1cf4db0513782fe00a7bf4645b98ba8dc57f79
-
SHA256
e5203022056fb93213d87cd82a081181c6abcdbdc1b1551441698d0f77d31bd2
-
SHA512
ec5038f00030f4c79d013da7109750f08b5478db74259841da20ab05573f74c78a046b463e8dfb27b2d2e4cef9e042f8bd2e1aa64fd24f31c3ce8c99b1a49122
-
SSDEEP
1536:QKeAaibBXdozfAo89RG06Ae6CQp4ohsVgz4MckwrDw:QrA7C8odApjx5z4f
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\15b7efe40667a8da268f02054732cd9b.exe"C:\Users\Admin\AppData\Local\Temp\15b7efe40667a8da268f02054732cd9b.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\15b7efe40667a8da268f02054732cd9b.exeC:\Users\Admin\AppData\Local\Temp\15b7efe40667a8da268f02054732cd9b.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
56KB
MD560c754f24cdfac8790d9286090ec3d6d
SHA13dacdfb372cfde388ce678a8870605e6bcf16443
SHA256f4559fcead8755b00327af5b935b2b566a61d0278fa5dae6c664958d90ba363d
SHA51290bd8b0e721f69908daf45bccbfb8ea5bb8b754aeff3f718df7cec071e540864876d3f4df5d579113425533f64ba6428f5ef73cc69f3d4cf776a0ca6c3cd2eab
-
Filesize
232KB
-
Filesize
108KB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
108KB
-
Filesize
232KB
-
Filesize
232KB
-
Filesize
56KB
-
Filesize
108KB
-
Filesize
108KB