Analysis
-
max time kernel
90s -
max time network
112s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
-
submitted
29/01/2024, 05:52
General
-
Target
7f0dae4d03e8c3965e009ad97d7a0c25.exe
-
Size
11.7MB
-
MD5
7f0dae4d03e8c3965e009ad97d7a0c25
-
SHA1
8f280c10c92b3211103a274129369084f166c44d
-
SHA256
0c65a7b42b8a008eb901ed5f4a68c9add502c1f5792d18f9bd560fa20c5b9e6f
-
SHA512
aa50281163e5b868dfe3914448d8087b8af2a85dff29c1086cdbf1fdd758aa2a8de66a68e1dbe63923ea590df986b7ceb1b698c127a99cc0afa9c6ffe801d11d
-
SSDEEP
196608:0f2Vu3gl/iBiPWhiVFZgl/iBiPxKyd+uPgl/iBiPWhiVFZgl/iBiP:Qs62ioFZ2iNUJ2ioFZ2i
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\7f0dae4d03e8c3965e009ad97d7a0c25.exe"C:\Users\Admin\AppData\Local\Temp\7f0dae4d03e8c3965e009ad97d7a0c25.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7f0dae4d03e8c3965e009ad97d7a0c25.exeC:\Users\Admin\AppData\Local\Temp\7f0dae4d03e8c3965e009ad97d7a0c25.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
202KB
MD56fd4b7abc5db065e48babdb63ae5983b
SHA17fcc25998ba3fb65a81b36a6f19ea70cac00b5bd
SHA2565eae8ff15d3f5e1ac0cb5c840e71a948b32314eeb58f28c12a5fcee953c0c5c1
SHA51218a4c12c430c20fecf4e99c0404cc05f25fbd2978c6843a090e3d51b22d45982e22697471a64ebb565278e4281ca6f32fcd68b20e9bf0751660a3f5df871758e
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
4.9MB
-
Filesize
2.2MB
-
Filesize
2.1MB
-
Filesize
4.9MB