Analysis
-
max time kernel
131s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
29-01-2024 13:39
General
-
Target
7ff8d1512d910ca1e655cdfa1e1859c9.exe
-
Size
1.3MB
-
MD5
7ff8d1512d910ca1e655cdfa1e1859c9
-
SHA1
e9ba02c0240a3a2e4284748b12a1aa160f72a6e8
-
SHA256
94d3f70c938c8e26bfcaac02d071f3fcaefebcafe614b94f7ad90c0380f0fd3c
-
SHA512
81a11fc3941b147391f86017b0d38155b8a7169fa030b301550dfa4eaf0d8f208ad0acfd8632fc53de247030e22da687f11d711b3765e7bf852601f103d1aca5
-
SSDEEP
24576:IAWa1DBt1V//7jfFLhy/iM5U28Vpqa/iLMWbhoqqTrzxX0rWO:Ixa1DBtqtnGxi/oqqTr1XSf
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\7ff8d1512d910ca1e655cdfa1e1859c9.exe"C:\Users\Admin\AppData\Local\Temp\7ff8d1512d910ca1e655cdfa1e1859c9.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7ff8d1512d910ca1e655cdfa1e1859c9.exeC:\Users\Admin\AppData\Local\Temp\7ff8d1512d910ca1e655cdfa1e1859c9.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
254KB
MD5735f3e1d21192e929f86b53e8624b2d8
SHA1d8c474c37b0c7846cb19a68bb4ec799716ce7713
SHA256ec3baac35dc7496811a1f44eb8a176b2e019c86bba19887243f088072339f6cc
SHA512f1a02ef962c098c03e3a1f7d9a2727fa2a9668639783ac07b11837f4be69bb8924c9a4c94835b0dda16ef663c6ddc9f2ac1619e6b7bce27ffa8bec17cb30c8af
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.1MB
-
Filesize
4.9MB