Analysis
-
max time kernel
141s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
01-02-2024 13:26
General
-
Target
86ffe8a742e3fe4842128c007230f24a.exe
-
Size
1.5MB
-
MD5
86ffe8a742e3fe4842128c007230f24a
-
SHA1
8a1e486765b7b6219cef53209a672865748ea103
-
SHA256
15f3a5912a0c973304195047b7580b468d6340213a770d61ecf89b870e3124e5
-
SHA512
6bd503a97a28a71914da2acbe41ad754aaac4b5c3bc5e66539da0d6004333d60c4c0179de479eadf408fd71b58ce2dcbefab140f525d2cde679761a1a3e69657
-
SSDEEP
24576:YswlBBSwMhstXhS5O+7nmoNGPf0498fa1FW4WCqhIMcPHyw3zEVcsyXi5W:EBBSwF08wnjof04p1F7/ZyDcsyI
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\86ffe8a742e3fe4842128c007230f24a.exe"C:\Users\Admin\AppData\Local\Temp\86ffe8a742e3fe4842128c007230f24a.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\86ffe8a742e3fe4842128c007230f24a.exeC:\Users\Admin\AppData\Local\Temp\86ffe8a742e3fe4842128c007230f24a.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
170KB
MD544dd17c3218c0f183c15b6bb3f5396b4
SHA1e209d29e3e3109e841f3cef3deda88d8d80df4f9
SHA25639e3de23407817cf9c78ad7e49b2c95f40fe86eb76cadcc90cc6cd209ace385a
SHA512752d335f7633155beafc13c91eb2b53284647d0d0def0c85321ec2aa5e95399d1d5dc0d8f57c527deae845894ed17c1561ff27f5e8540f5ae5a016c30a250e48
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.1MB
-
Filesize
4.9MB