Analysis
-
max time kernel
140s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
15-01-2024 02:40
General
-
Target
5bebd335aa3b9ede5c96a6afda7f4111.exe
-
Size
115KB
-
MD5
5bebd335aa3b9ede5c96a6afda7f4111
-
SHA1
fd260950fdbefad371e4021b49079e934db6e4e3
-
SHA256
480007af224753ecad35e15b521521cd820b8afb743428b1be4452a1f201564c
-
SHA512
f165ec7ff4b3aa8d4e83a03affd418e9227c40a18ada5beb15e6291ca0a627b5fa8e26f66817310796f56dc418d015c762c320a69910c97803ae4f9a916cc963
-
SSDEEP
1536:9UrQsaqLX6ZbnWInk7bq/jq4LxHwHpKxopJ13zvOZjW2QjjTQU49YxdRvyCSyvLF:rUX2laHUxuWFGXEU49YxThzDSWNSE
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\5bebd335aa3b9ede5c96a6afda7f4111.exe"C:\Users\Admin\AppData\Local\Temp\5bebd335aa3b9ede5c96a6afda7f4111.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\5bebd335aa3b9ede5c96a6afda7f4111.exeC:\Users\Admin\AppData\Local\Temp\5bebd335aa3b9ede5c96a6afda7f4111.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
115KB
MD5b5ce50efb075c89b3b7728ee2fe11bbe
SHA174bde0e46a16302704b79725491c41a2c50e77d0
SHA256152fa137a00a3736634bc8025b7fe35048a5b7eee9bb496009ca71c57633c5cc
SHA512e84ef222178bb2cc3cea195803a90c6e0a47bb7e37d2e1b18ea6e1bc66c299cdd1c76a7245b853409dda53bd4bc439394c1b4ef4525db0e39f860f0e03cd8e1d
-
Filesize
468KB
-
Filesize
116KB
-
Filesize
116KB
-
Filesize
116KB
-
Filesize
468KB
-
Filesize
116KB
-
Filesize
56KB
-
Filesize
116KB
-
Filesize
468KB