Analysis
-
max time kernel
190s -
max time network
217s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
30-12-2023 10:45
General
-
Target
164f39732af9382a5bdb34ca1dd1c198.exe
-
Size
1.5MB
-
MD5
164f39732af9382a5bdb34ca1dd1c198
-
SHA1
cc32eb4add738a5a6402b2993513c66acdbc18bc
-
SHA256
075b6b99baf431c397c664709a0e7290ba9750e5999109e77239e9aba6d47e7c
-
SHA512
dc4b47f0f6988e105a415410cd647fed1f0afc03f6403726893371d0f10cac02aa3acab2cebd409f9a8387865253fd9baf68ceac4e53e0f28b6a41feb2aae936
-
SSDEEP
24576:JQ89DlmM0F25yXc0DIVJgDdqdpqXhlH/lyLW/hKcSmTjYM34DZk82nbXW:r5Ew5yXc0MVJIgPqRlHALW5qmQAgk
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\164f39732af9382a5bdb34ca1dd1c198.exe"C:\Users\Admin\AppData\Local\Temp\164f39732af9382a5bdb34ca1dd1c198.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\164f39732af9382a5bdb34ca1dd1c198.exeC:\Users\Admin\AppData\Local\Temp\164f39732af9382a5bdb34ca1dd1c198.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.5MB
MD52a7e1fb0141b30c35b7d01deca3ce9bf
SHA145260111a9303d407053dfd4724ef435180b611f
SHA2568a78bf636caa1876f4540f991230e75d357ef1d4b80ef1e2f7545bde652ac518
SHA5120e4f140e19282a05f7b7c0da1d993f73fe93be047c8397d1efc8f3a2e9b8ee261026ab21ef04c2796f9a115fe746dcc063f0781163e8b35de83679a217bb3e3f
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
4.9MB
-
Filesize
2.2MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
2.1MB
-
Filesize
4.9MB