Analysis
-
max time kernel
169s -
max time network
186s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
31/12/2023, 04:40
General
-
Target
2891e13b1f14851baa042189d2f991c3.exe
-
Size
1.3MB
-
MD5
2891e13b1f14851baa042189d2f991c3
-
SHA1
35d3abca24f4ded4071b81d2ea37318ac50c4b0e
-
SHA256
8a12d5d8ffbbb1c21d1dfa0342e1a0082dec46dd861c83a5ef47c7019fd3bfe2
-
SHA512
a700e23cd6d3d2c3e02660382416cc60f6ec2897da88407d43f90ea1bec972d756c17615630682620a02396eeabbed3d466bb78fba7d03003c8eee315b52f26b
-
SSDEEP
24576:yq+de+IKmYiAEODcJn84lRIWe3vyQ0eLWaKFu8E+dtVonABoJyDcOggvG:b+IKmYi2cdDXjiqQoaKnQ
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2891e13b1f14851baa042189d2f991c3.exe"C:\Users\Admin\AppData\Local\Temp\2891e13b1f14851baa042189d2f991c3.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2891e13b1f14851baa042189d2f991c3.exeC:\Users\Admin\AppData\Local\Temp\2891e13b1f14851baa042189d2f991c3.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
960KB
MD569790c2271cf3b308a0ebdd9dea747e7
SHA176d2b15ab23837f576217895ee32d0f71ecedb4b
SHA256b14e720ac2cb3a527a0a7a35eb215dc43e6f94e4790c48b3cc65dfc525e207a1
SHA512e5ae956120e7cf19f37a77e5f2f8b2a253f43872ffb8e10522ae526b7862ae7f003144cdbb913d65be37bfe2490350ce4662629e7d09c69359ef21680f0d9a95
-
Filesize
4.4MB
-
Filesize
1.1MB
-
Filesize
4.4MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
4.4MB
-
Filesize
1.1MB
-
Filesize
1.9MB
-
Filesize
4.4MB