Analysis
-
max time kernel
140s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
-
submitted
30/12/2023, 20:26
General
-
Target
1bd29df961ff17fde8f08f0627f50b6f.exe
-
Size
68KB
-
MD5
1bd29df961ff17fde8f08f0627f50b6f
-
SHA1
f765af2682050aa61204a73bb37cbee57fa9142f
-
SHA256
1debcf2f1f195750132b1a6fe7690122f4dd561382ab0d6f1b0d1e6a63d70b78
-
SHA512
520ff0a744b89eb5ce45756d2bdc73e26dd3e452703a5f5f616504a3cfb7aa3cbde3cf52b48cec6aaef2238f5e0736774954caade17a452662a1a4a53c20cc57
-
SSDEEP
1536:OwX3xrIlwhjCLFo/3Vy7JudmJitA7YTXwgiAGPuFdbsk2q0CmuJdr:bX3JtjOe3VIJBitAsTdrJdLBbdr
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1bd29df961ff17fde8f08f0627f50b6f.exe"C:\Users\Admin\AppData\Local\Temp\1bd29df961ff17fde8f08f0627f50b6f.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1bd29df961ff17fde8f08f0627f50b6f.exeC:\Users\Admin\AppData\Local\Temp\1bd29df961ff17fde8f08f0627f50b6f.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
MD536ca28e4f37018f4e2b8ee63afc17f44
SHA127a59ac84889572ff077bd0ad689c08a39f08269
SHA2560028a748708c321a8ca6ef692ec4172059520ceaade127df86b0d21445ebea5b
SHA51208e9ee7e7337aebdb9c64f8788ce96954b3c5c60321b0b9adeb7938dcbedb7b1bc79702fad0a001e471de41aec6b1a3ac67eda321c7b8e2fb57f8a873a83f87b
-
Filesize
232KB
-
Filesize
56KB
-
Filesize
108KB
-
Filesize
108KB
-
Filesize
56KB
-
Filesize
108KB
-
Filesize
108KB
-
Filesize
56KB
-
Filesize
232KB
-
Filesize
232KB