Analysis
-
max time kernel
145s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
-
submitted
01/02/2024, 02:12
General
-
Target
85a80e2d0c5ae2cc9034916f480c177c.exe
-
Size
8.7MB
-
MD5
85a80e2d0c5ae2cc9034916f480c177c
-
SHA1
f878d8064fea95bf2d00985fe562e47ac6a5b8c3
-
SHA256
3e6ac8a8da25c67621d8b7c98df9f8119b9239e7ce95be846653c239e1eb156b
-
SHA512
d85bdb43bcb0c3a7743ae40b02fdfcce07200015f65a3995255cd7202e75da9dab4a5f3ce352711a8176d87017de000377556a57b312e9f0bc0ed18290dea506
-
SSDEEP
196608:2IiLXWC/f1q3ULWCmZaoky7y6WC/f1q3ULWCX:2p7h1q3ULYZaokyLh1q3UL9
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\85a80e2d0c5ae2cc9034916f480c177c.exe"C:\Users\Admin\AppData\Local\Temp\85a80e2d0c5ae2cc9034916f480c177c.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\85a80e2d0c5ae2cc9034916f480c177c.exeC:\Users\Admin\AppData\Local\Temp\85a80e2d0c5ae2cc9034916f480c177c.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
381KB
MD570723b243d442b069c83ee2eca754b63
SHA1f5c5a11299e30b4b18ae98105e3f712ad26d5016
SHA2566263783579ffeee3db9d271bca2cba09bfa6c2c9a83da40bfcb276ee9be562df
SHA512758476b51cf7325fbb1ca626c7cc3eb671c9de8e6e796d99915e78e5b895cfeb5e9d1e54e5567b4da429ebb0f4322db39dd58b8121cbaa5b0d1120d013732ad1
-
Filesize
1.2MB
-
Filesize
4.9MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.1MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
2.2MB
-
Filesize
1.2MB
-
Filesize
2.2MB