Analysis
-
max time kernel
149s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
31/12/2023, 02:50
General
-
Target
252f88632fc656dd3703513b2c1d67ed.exe
-
Size
1.3MB
-
MD5
252f88632fc656dd3703513b2c1d67ed
-
SHA1
2c29e3e4d2bd3b1d15b694f2d5977f94594663e9
-
SHA256
9fb99d1afa435cb19b98d64f0ccd04dac5ea82bb8bed26410fc1e567b29ac4c8
-
SHA512
4aafc64a758f7d82b787ed9a00784e365f14c8d4b7eb11cbc00991b22b43a099ec926b69fb48fdba7852cb36551b6992388808f4a2cdfcb55c638cf829d7dd49
-
SSDEEP
24576:RZlinJlMi3r3XaDvlFeYnB+gvKxnYjcHq8e8ihR6RWGSQcZ+WO:PlWnME3XabnTrcKeS6rSQc+f
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\252f88632fc656dd3703513b2c1d67ed.exe"C:\Users\Admin\AppData\Local\Temp\252f88632fc656dd3703513b2c1d67ed.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\252f88632fc656dd3703513b2c1d67ed.exeC:\Users\Admin\AppData\Local\Temp\252f88632fc656dd3703513b2c1d67ed.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
69KB
MD5563397b2bbf74c3317261dd325c9b7c2
SHA1839a992b6e367123f76018e830136308e76cc951
SHA256cb32f4db4f50f1a740b4d8aac6a2afb2dddba3cbfd56276e39091d78dfe4f36e
SHA512029992ad8384bed6207079d9b58ce18040be79020eba7d2684abcae5c5dbdd1b9d87e8c21713b1d3c1214d3fd91bdca2d8843a3046d6693f8d91f2c433ec19cf
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
1.2MB
-
Filesize
4.9MB
-
Filesize
2.2MB
-
Filesize
2.1MB
-
Filesize
4.9MB