Analysis
-
max time kernel
145s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
13/01/2024, 07:33
General
-
Target
58583eab1f1ecbde2023e96474aac5ab.exe
-
Size
11.7MB
-
MD5
58583eab1f1ecbde2023e96474aac5ab
-
SHA1
252241bd631c295da93d9421802f4c30805b1c53
-
SHA256
162368b52fa91fa1f232396a2a33aa09ded1625ad7fa0b554da21ebef6a5925a
-
SHA512
56dc0cea611228396839f957ddbeab5edab80fad6784465e698dacabb30696b45124e7591f128054cc695df74e103e4e7050b47ee83fb25dc5920baa9c5d9af3
-
SSDEEP
98304:pZcmHYqJVN4HBUCczzM3DqNBYWOPUXf4HBUCczzM3i/j3zdtKnKXR4HBUCczzM31:pOSYqcWCnqstMXwWC0j4WCnqstMXwWC
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\58583eab1f1ecbde2023e96474aac5ab.exe"C:\Users\Admin\AppData\Local\Temp\58583eab1f1ecbde2023e96474aac5ab.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\58583eab1f1ecbde2023e96474aac5ab.exeC:\Users\Admin\AppData\Local\Temp\58583eab1f1ecbde2023e96474aac5ab.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
641KB
MD5b43e384bc183f61be80c96aa53dd5d81
SHA18756ada17594801bb272570a545240b8ad62bbcf
SHA25658b55423b9cde5e3787573ed9d6ca1d656405a0f3469cbc44c9c3bc89d716626
SHA51274a25394c04e325c0e3c638ac35f63da53c9b7dbef30d67be524958e27d21c4bd139be19a59e6e9c8626cf17277cc3ac6026c8abb5f2aa3bb29d4a6b03206f8e
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
4.9MB
-
Filesize
2.2MB
-
Filesize
2.1MB
-
Filesize
1.2MB
-
Filesize
4.9MB