Analysis
-
max time kernel
152s -
max time network
164s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
31/12/2023, 21:08
General
-
Target
3b0de53f3e7d53474085600f89a10914.exe
-
Size
1.3MB
-
MD5
3b0de53f3e7d53474085600f89a10914
-
SHA1
863f32c4f24949c1d1b2d265129c8154967ccef0
-
SHA256
5d243d5f90f3f0ef54868a437e11be6fbe8361f6245933ae088b4aa405ffeeae
-
SHA512
88a22fbcd4cff0b28c19af54e73b9a82bf012df74861ef7105c0c5297c4c32eb1d3058357568c0a0b4eba03f1bb586c74402a43f058bce9b4529d5fd887d1a60
-
SSDEEP
24576:HIGb7ulgWb0OKXW6RJWxeIL13WXI1ib6cD0uosK8nYO2Cru6awqSdjU1YAWc:HHb7o9hf6RJWxxF1ib6sbKiu6awxdj2t
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\3b0de53f3e7d53474085600f89a10914.exe"C:\Users\Admin\AppData\Local\Temp\3b0de53f3e7d53474085600f89a10914.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3b0de53f3e7d53474085600f89a10914.exeC:\Users\Admin\AppData\Local\Temp\3b0de53f3e7d53474085600f89a10914.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
75KB
MD57b361ae4d299e1012f18cdd6d3c554ed
SHA199fb47c36defae0099eb6b5dcaeac292d40875c6
SHA256f6f75156ef69fd2bcf2892dd0a3011338ebc4e9562294dbecce19eb7bd062f29
SHA5120f8340c3bded99073a097bca982e40b3441cddb2f72415bd062f0ff8e04a1cc13b78fc6c09a6760441f70e6c7a6785f1405cbc86ac0dd2afcdded41d501672e4
-
Filesize
4.9MB
-
Filesize
2.2MB
-
Filesize
1.2MB
-
Filesize
2.1MB
-
Filesize
2.2MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB