Analysis
-
max time kernel
168s -
max time network
189s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
31-12-2023 03:33
General
-
Target
2684a80790f79192051a6afa8e010a75.exe
-
Size
10.6MB
-
MD5
2684a80790f79192051a6afa8e010a75
-
SHA1
966fb46f7269188c2f5a748306e03a31d6eb2f3e
-
SHA256
5d92f09dfb240fa084c3f60b5fd2cbc37c437e4cbe0b706306b3b1d266b6d6bb
-
SHA512
bb016863769fa1696149ad13a06fd7d0429aac8523973fa135ab7542c66aacacdb258227649a5756f6e97fd2d52f49d6f742ef15995073e3c3cc5979ded59fdb
-
SSDEEP
196608:c1Per6DMlUTqCH/5eBLEXPhTqCH/8mnpAnj6TqCH/5eBLEXPhTqCH/Y:eGrUSUTTf5eBLwpTTf8m6nj6TTf5eBLF
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2684a80790f79192051a6afa8e010a75.exe"C:\Users\Admin\AppData\Local\Temp\2684a80790f79192051a6afa8e010a75.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2684a80790f79192051a6afa8e010a75.exeC:\Users\Admin\AppData\Local\Temp\2684a80790f79192051a6afa8e010a75.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
92KB
MD5c6a5afef06a67198589466cf52da389e
SHA1cefd0d4c7fc29d9910d5c0a09adde11d19d5c75d
SHA2569bddc64a0f51cea2b59b4cece47685271eef482dc8d32aabe1aa0529ce7af708
SHA51200ef8754aea9b2b254686af23096079fecb554c8d27696eb138be314cceb96787f8290e2d85c601f709b6b44813a879f3765223bf96cdd55a2baa489ebf9a0f6
-
Filesize
1.2MB
-
Filesize
4.9MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.1MB
-
Filesize
4.9MB