Analysis
-
max time kernel
145s -
max time network
165s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
30-12-2023 10:25
General
-
Target
15d9b94a64e593395443eca8eef69065.exe
-
Size
2.9MB
-
MD5
15d9b94a64e593395443eca8eef69065
-
SHA1
fd6c5dc6172624e4b4ca3988bd2a247409e2b722
-
SHA256
bc754b50caa691cfd8a50bc88ae1820bd5ad1cf0c703886d330ef7cabbfad271
-
SHA512
e5d6dd1f92b530924a85d76682cd396a25ff3e46f5665f7b9073754593b8370583b88b842609570876275ee32e6f6888a80d97d0272c8f6fa842fe1db81a4698
-
SSDEEP
49152:xC29GpOQGssyHUno/a0NF1ZTPON74NH5HUyNRcUsCVOzetdZJ:xX9GpbsysoX71Zq4HBUCczzM3
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\15d9b94a64e593395443eca8eef69065.exe"C:\Users\Admin\AppData\Local\Temp\15d9b94a64e593395443eca8eef69065.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\15d9b94a64e593395443eca8eef69065.exeC:\Users\Admin\AppData\Local\Temp\15d9b94a64e593395443eca8eef69065.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.9MB
MD5a63e641203a12c14ae80399b4e658b7e
SHA1324ab725be22e948eed84ac9b197b91e0b7a9059
SHA256f62ea264b798530cb17430a0c2b14c8140f4c7afbd452553a6b00fc5e0f3205e
SHA512eada3c9f248d1c132d6c8a0606639187694f82f9e6a942c382fe3a988eb6c0009346609c7a1a98b3d12800d640175d61b20339d781a422ca6bf66afa7feef4f3
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.1MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB