Analysis
-
max time kernel
150s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
30/12/2023, 14:17
General
-
Target
1b2b8cd57a5d88d44570411da9df85ae.exe
-
Size
5.8MB
-
MD5
1b2b8cd57a5d88d44570411da9df85ae
-
SHA1
910ab66d3514135f16bd8b3c1627d64ae97290fa
-
SHA256
978d64ba5b8e637eef63d2fe924d0d192b2b632bba8a12c0143e00b9237552be
-
SHA512
4925b9105d5d27f6011b7918a0110b051e7bb1c2a7bedc2744fc2beda85df7810a4e9bee31247a8e9459ad2f30ac9d3be3a2aa4479017466dbce48e7acecfeda
-
SSDEEP
98304:LAN+L0QkS5WaeakYbvgJhVd6e7QqvzYSwBnh0Zppynt1kYbvgJhVd6e7Q:cozkS5qgE6kFY5nCZp0tigE6k
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1b2b8cd57a5d88d44570411da9df85ae.exe"C:\Users\Admin\AppData\Local\Temp\1b2b8cd57a5d88d44570411da9df85ae.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1b2b8cd57a5d88d44570411da9df85ae.exeC:\Users\Admin\AppData\Local\Temp\1b2b8cd57a5d88d44570411da9df85ae.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
929KB
MD559d5cd337b86b9134d9c6cd914a5c9bf
SHA1d3a39c1a018571aea2977838e584a540661a29a1
SHA256e1f9e9951a267db57f7386f29ea3043235e9ee7e3075e47000cbae55817090e2
SHA512ba826415d379a2a91957252cdfe94f2af10db6a4f92edc9d347e418f2e2ddeeca34952d2291d4e48b25f8d36ebbff17359877985fd401770d2698f989b2a1c49
-
Filesize
4.9MB
-
Filesize
2.2MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
2.1MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB