Analysis
-
max time kernel
142s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
01/02/2024, 08:45
General
-
Target
8671b992da213a51468c3d847faf5d9b.exe
-
Size
353KB
-
MD5
8671b992da213a51468c3d847faf5d9b
-
SHA1
ac236f5552679cfb07c5e52ad32e8ee76058e031
-
SHA256
f1c872d4cbcc5df703d9c83531adf09adc176bbb7b20a6f44d4dc938fa689614
-
SHA512
d3b01b4bae0e8d91c5c83bae3b73c9051630918024bad2fa4495fada2d3c398df129f979f4304d8a0f99de462a93870889094833f3187969c38cbdc6e1221115
-
SSDEEP
6144:9/e1yxwibYgmUO0sQNovhtEHdXveeZe1opHYdxfsLPrPwo+:eewibYFFPvjE9eoYTfmE
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\8671b992da213a51468c3d847faf5d9b.exe"C:\Users\Admin\AppData\Local\Temp\8671b992da213a51468c3d847faf5d9b.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\8671b992da213a51468c3d847faf5d9b.exeC:\Users\Admin\AppData\Local\Temp\8671b992da213a51468c3d847faf5d9b.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
59KB
MD551b6b730fd5e7689003c30e89abb15db
SHA1426c6f129884d8da43b779aa0fc762383b5959d5
SHA256e534025efbba6cc39e2d06a997d34f7be610848109b017aa722453690f6ffa29
SHA512a35f2592d6fd67851be72184be5218fc39c0b1ee2cffcafa50272b5a8fb85f1f0addb6bb072a473d8bb926aa04b392af40aa6f9fff5b0d316fb2d390b3fae327
-
Filesize
964KB
-
Filesize
204KB
-
Filesize
320KB
-
Filesize
264KB
-
Filesize
320KB
-
Filesize
964KB
-
Filesize
964KB
-
Filesize
204KB
-
Filesize
320KB
-
Filesize
320KB