Analysis
-
max time kernel
174s -
max time network
202s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
31/12/2023, 05:23
General
-
Target
29e0108d967d50a4080e73ba5bad7d31.exe
-
Size
4.8MB
-
MD5
29e0108d967d50a4080e73ba5bad7d31
-
SHA1
91a16b90e38ab7832f1ddd033051268c2e2b5d7d
-
SHA256
42aad4ab11d0638c4f36bb8f9f7125fbcd7f2cf5a0832bf8dc021ea684db1c2a
-
SHA512
079cb5b55a3a0342c43a42993b07b2aadc958af7ba658dc5a44d32de35b56ff442ff109f3eecce7f5a27e3b3c00c8002fcc5c572a30d9699a33cde88f5c7e6f8
-
SSDEEP
98304:u6SJiVPDgg3gnl/IVUs1j6HybIF1yl+zWHgg3gnl/IVUs1jr:u6tJZgl/iBgybIXylNlgl/iBP
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\29e0108d967d50a4080e73ba5bad7d31.exe"C:\Users\Admin\AppData\Local\Temp\29e0108d967d50a4080e73ba5bad7d31.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\29e0108d967d50a4080e73ba5bad7d31.exeC:\Users\Admin\AppData\Local\Temp\29e0108d967d50a4080e73ba5bad7d31.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
147KB
MD5ddd90b6659c0021bfa3009aee7eba18f
SHA11d567bbcfc84729866f86f742035105c0d17b9ac
SHA256892c2f43cebbf07dd6827a98a5c8a10f1d8ee55d7ce8061d2edc108111cbb8e7
SHA5125e0ae54d4f3346852c8ca57cd917628d78587f9abc5ae29198bf01f6e6ae7bd173777e98b4b881390a99ec95d9ee85b2028e4b90e01ea38c0f07340c961f6123
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.1MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB