Analysis
-
max time kernel
148s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
15-01-2024 03:34
General
-
Target
5c0786d64f38710a76e1ed11224119e6.exe
-
Size
1.3MB
-
MD5
5c0786d64f38710a76e1ed11224119e6
-
SHA1
101c4e03f8b863f20fec2fc28a8843096a06159e
-
SHA256
8be9ee0d08146cb867639a473ef12780f6cf2d8712312070c5c8b494630ca7ca
-
SHA512
3d1f661c257fbc70b7abf38e358dab8e5630ba380820ec84e5bd6a647254ee4d73b47c8a614ebb2d0d6d17e1792fd9acd8dec5d8bf47ed696287f5ba7f0f2fbe
-
SSDEEP
24576:BnTvD2QNT5hu/JFKlQ0sP6HPgjt1ap0sVh/A/JQbbWc:BTvTNTK7KO0O6v8tQprho/Jqbp
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\5c0786d64f38710a76e1ed11224119e6.exe"C:\Users\Admin\AppData\Local\Temp\5c0786d64f38710a76e1ed11224119e6.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\5c0786d64f38710a76e1ed11224119e6.exeC:\Users\Admin\AppData\Local\Temp\5c0786d64f38710a76e1ed11224119e6.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
971KB
MD57145d3b4f4baf5d3b047e2df9f31420f
SHA167487d52d857f497b5b3a0b588a4bf5ed1a817e3
SHA2565138acb612a3a345d3ba9e143110105de5ba7dad9b6fcaab70ba96e59bfb7628
SHA512c70534973c79f5aab669a5383681dcf7fc5d4d51c46087b663a5260473edc460a191422ac8a2fb399185cd4a4b6aca6fa842cf95981e5422de1582fff3aebd4e
-
Filesize
4.9MB
-
Filesize
2.2MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
2.1MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB