Analysis
-
max time kernel
147s -
max time network
184s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
30-12-2023 10:53
General
-
Target
168177d3b5f07ec5df7c0e4ebeffa87d.exe
-
Size
2.9MB
-
MD5
168177d3b5f07ec5df7c0e4ebeffa87d
-
SHA1
a54977665cf7d9bb679912c0fc47c8a3d888638e
-
SHA256
5f29d81b9c210b4ca81bf2d7be7b3bb004fa1076068767479a3f705763939efd
-
SHA512
40b1f2f45350ef239b868264fe7a1a1cc84e3d0a7d2f679dff29bf9461c8500b63fa03225d71b827a503fb7735158cb70b89c603cb73474400582bb8aea2f04a
-
SSDEEP
49152:ytUZvh9zM2ohwYI1HoI+U/XwqqQpSokV/UPJKwzQaD1a/D+dJd/DJt:Rhod4H0OgNQARV/URKhyphDJt
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\168177d3b5f07ec5df7c0e4ebeffa87d.exe"C:\Users\Admin\AppData\Local\Temp\168177d3b5f07ec5df7c0e4ebeffa87d.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\168177d3b5f07ec5df7c0e4ebeffa87d.exeC:\Users\Admin\AppData\Local\Temp\168177d3b5f07ec5df7c0e4ebeffa87d.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.9MB
MD515bf4d645b744d5b6857b398ffb3a586
SHA1eaf971ab66b4823852e12eab6e75a6a8f96ff040
SHA256e0535b96e7761939e10757f8bd5f61b8a8669df17cf3dd8cfdca169fb00b6b12
SHA512bedc44a6e5ff418daaf3746d342841c8ad370c87c5a429913448088bb1520f73407d8294327c79c99872878bd1b60aff5d3b1b3592be779474fe705f91e57e7f
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.1MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB