Analysis
-
max time kernel
213s -
max time network
247s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
31-12-2023 14:03
General
-
Target
390d01f4b80316f022734623f644a369.exe
-
Size
1.5MB
-
MD5
390d01f4b80316f022734623f644a369
-
SHA1
f837da3f4db463dea53a7b4ff40fc49c0a69fa89
-
SHA256
0637f7b3f7581aa8ae091650b48224397cb450d885564ae82d29046a024354f8
-
SHA512
625123db2b5535d530ebc9891e6460b062137f786b294ad19f2e53afb02ea73b87c7789ca7cf26b8ec88ecc9de6f97daca53254dbb903664bda8e755301b1181
-
SSDEEP
24576:HaS2C/5NcsFbdclzIV1Gtg/YNkRPRtKNkIul7tFejmNadVVrW:6YrcEf/YNk/tKdulJrNmP
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\390d01f4b80316f022734623f644a369.exe"C:\Users\Admin\AppData\Local\Temp\390d01f4b80316f022734623f644a369.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\390d01f4b80316f022734623f644a369.exeC:\Users\Admin\AppData\Local\Temp\390d01f4b80316f022734623f644a369.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1024KB
MD52e12c12504cbdc30682803a94c38c31a
SHA14849cf548e15cc3fec4557473c6f2cc2e25312af
SHA2567b4758b002ece2569e300b2743f5ee031718b5f75fa6ff276838b16600e0af04
SHA51285983a9de9a11e19fc4c85b2c63f5a129604806baeb41153b91ab1ae3896260b4667c80c094d76dfce1c20cbb14c096e8ff5c711991a120688ce280bf69830f4
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
4.9MB
-
Filesize
2.2MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
2.1MB
-
Filesize
4.9MB