Analysis
-
max time kernel
165s -
max time network
180s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
31/12/2023, 00:09
General
-
Target
21245c6a9f4fa825e067dcc56b199ff8.exe
-
Size
2.9MB
-
MD5
21245c6a9f4fa825e067dcc56b199ff8
-
SHA1
22f58b590f421a3589f3bb0ba38bebe07c6a5d97
-
SHA256
cad80a438450f912be880593bf7cd7cdad063a4e04ee26eaf5b86f8bd17e35b6
-
SHA512
06b76844d2257f5597a70fdd26c42b5bfddd5b70ccd4abe90040cdcf056486dc94f65b31236a75a8d2e68c45fc778cf2d82d12c153359821aac0203ec395b331
-
SSDEEP
49152:9ZpCVOJWUumDss073gU6P0MqxDlsWN74NH5HUyNRcUsCVOzetdZJ:9ZpqOAUuma7TEW4HBUCczzM3
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\21245c6a9f4fa825e067dcc56b199ff8.exe"C:\Users\Admin\AppData\Local\Temp\21245c6a9f4fa825e067dcc56b199ff8.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\21245c6a9f4fa825e067dcc56b199ff8.exeC:\Users\Admin\AppData\Local\Temp\21245c6a9f4fa825e067dcc56b199ff8.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.9MB
MD55ea9f113bf468a1a7a8fc3fe608f8c26
SHA14874ab6b0f9f96932a3eaf02f86caf3fdb82aa7b
SHA256e93c98e4705faf0f4c77b43bec36bd99992301ca34c55f425ee789a78c4580e0
SHA512b7091dfcf26b210aa8371860f1f861f96300bb4bc0a8d7fde79a4138812ea5160ec0c6bf6338951fb7962cc85a4f2cae4206cf754a2dbb5cc6fdd8a31b836acc
-
Filesize
4.9MB
-
Filesize
2.2MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
2.1MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
4.9MB
-
Filesize
2.2MB