Analysis
-
max time kernel
109s -
max time network
107s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
-
submitted
31/12/2023, 07:04
General
-
Target
2ca7825e8ccd527abc5a049c9900f6f9.exe
-
Size
2.9MB
-
MD5
2ca7825e8ccd527abc5a049c9900f6f9
-
SHA1
2857b5bb6a0c4355c8dc775db0392dcf25e36d7a
-
SHA256
2fe33e295b3f4d7fc045205c01c72947492065819389264575f38152bdf117d1
-
SHA512
4a5deb456521a685eaca79b95b9cc7759258b38e6faaab97880d44356edc5baeaf53936fd8f22c9195928412dc947acda2d44c3c9a09893aff05956141a1ed6c
-
SSDEEP
49152:6x1dWVn8D8eWMtl/7sUqMz8zq1oyCJN74NH5HUyNRcUsCVOzetdZJ:mcVnq8BMtp+V5yCJ4HBUCczzM3
Score
7/10
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2ca7825e8ccd527abc5a049c9900f6f9.exe"C:\Users\Admin\AppData\Local\Temp\2ca7825e8ccd527abc5a049c9900f6f9.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2ca7825e8ccd527abc5a049c9900f6f9.exeC:\Users\Admin\AppData\Local\Temp\2ca7825e8ccd527abc5a049c9900f6f9.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
2.1MB
-
Filesize
2.2MB
-
Filesize
4.9MB