Analysis
-
max time kernel
151s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
31-12-2023 13:28
General
-
Target
380596b6321f723b1cd8bec9459d6acf.exe
-
Size
5.3MB
-
MD5
380596b6321f723b1cd8bec9459d6acf
-
SHA1
1a73123b8fc8026fd83688ad12c201c308f17f9f
-
SHA256
910b251fd99f568f2020ef678801eea400f3e195010286b6029cb9bb99b9cbe5
-
SHA512
fb58814249ddff3d063e8631aedc77c80de8d1505ba6ac39cd1a16b0807a945b90c64f5753e4b4576b903c674fd850813a6cc2f3b1264c4c8c894719fc4db037
-
SSDEEP
98304:937UmQozO4uHUv38C5hX+Ska4H1FoVyOwMEHUv38C5hX+Ska4Hj:93wmVON0v38aXMBfXv0v38aXMBD
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\380596b6321f723b1cd8bec9459d6acf.exe"C:\Users\Admin\AppData\Local\Temp\380596b6321f723b1cd8bec9459d6acf.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\380596b6321f723b1cd8bec9459d6acf.exeC:\Users\Admin\AppData\Local\Temp\380596b6321f723b1cd8bec9459d6acf.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
249KB
MD56a7f8891d1017e1b014602419d551af9
SHA171f8751188275b9e1046f10f4af02afcc1a2fe35
SHA256773c17e74cbee933f3ec87cb3f64567951bf65e875b5c7b17efe4d030ca1db85
SHA51233197ba9d56232f85df93793584c962291b1a501a3faf76133157ab5e99b938e00ec7bbe0f73eed073890db43c108bad3d2f4b248d229b22e056ddb01ded89cf
-
Filesize
4.9MB
-
Filesize
2.1MB
-
Filesize
1.2MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
2.1MB
-
Filesize
2.1MB