Analysis
-
max time kernel
158s -
max time network
180s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
31-12-2023 06:21
General
-
Target
2b8eae6a9d19ae2459c64c0fd58058c2.exe
-
Size
2.7MB
-
MD5
2b8eae6a9d19ae2459c64c0fd58058c2
-
SHA1
1c84ebc0a2583669f53e19428f19c8ead2a8a947
-
SHA256
432591d516cdec05992062487866aa0081e1cfedaf7c57bb256ff8bb2ab81196
-
SHA512
1e44f0e5b032f664cc3c5019661c313e916421a1e07bfd38e55aeb31c0d84349c85c38626700804f2081942bf64d0eb23ddbdeb46b489e3b9123872073e41ef6
-
SSDEEP
49152:/lN1j6iQoap1FHaCMWnuEG36xt+pob5D0urIWn9ID1A/ObR5P0M9RbezQetp:1jzOp1F6CMo/+DW9ID1G4Rl0PQetp
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2b8eae6a9d19ae2459c64c0fd58058c2.exe"C:\Users\Admin\AppData\Local\Temp\2b8eae6a9d19ae2459c64c0fd58058c2.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2b8eae6a9d19ae2459c64c0fd58058c2.exeC:\Users\Admin\AppData\Local\Temp\2b8eae6a9d19ae2459c64c0fd58058c2.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.6MB
MD5dcedd7afbe86b95e9f9de3253723f353
SHA1b68f0a3dd4ce3ab4fff8e603a4aa76f99032e04a
SHA256f28a0535ea8e11950cacc59d349415105f421646b4ad8c99b49601b296ff939d
SHA512682d89e43ac0cd0de577af4c4d976673220695fc9171bd4fa862d7a7c7c4e734262c249f0a481974ebb2be46be03e850e34389376c50d5dff4091cb49889d09c
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.1MB
-
Filesize
4.9MB