Analysis
-
max time kernel
145s -
max time network
135s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
-
submitted
31-12-2023 13:51
General
-
Target
38b9464cf2285a3e0035762599bb333f.exe
-
Size
5.3MB
-
MD5
38b9464cf2285a3e0035762599bb333f
-
SHA1
3aeda74cb41d4821e7f0940d619b36dad0e84218
-
SHA256
9a65bc8182c01a8726fe3b6ec39243880a1aa3c75f641b24b6bce785f2d392f9
-
SHA512
9f2813d925164a4603873454e6582aa9546f5a3cee0912c829cd2a78526081aa8f3fcf03a718438f9e8412bcbe0cb5491c4ee8e1c18287499622bf18f091b09f
-
SSDEEP
98304:CPti9X06r/i1HCQCFqagNBBTt5+mzrbjzHiZmoiC8m3vaB1HCQCFqagNBBTt5+mn:C1sE6aiQ0qakBR/zrbjz3N1qa1iQ0qaI
Score
7/10
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 1 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\38b9464cf2285a3e0035762599bb333f.exe"C:\Users\Admin\AppData\Local\Temp\38b9464cf2285a3e0035762599bb333f.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\38b9464cf2285a3e0035762599bb333f.exeC:\Users\Admin\AppData\Local\Temp\38b9464cf2285a3e0035762599bb333f.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4.9MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
1.2MB
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
2.1MB
-
Filesize
4.9MB
-
Filesize
2.1MB