Analysis
-
max time kernel
91s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
-
submitted
03/02/2024, 05:11
General
-
Target
8b7b574925f05bf8e431e8307647cb60.exe
-
Size
5.8MB
-
MD5
8b7b574925f05bf8e431e8307647cb60
-
SHA1
4a9b902969b000115ea87d50d1f246c6ebc47e46
-
SHA256
85dd75da6b158661977db18e5849c684fd0a5b857a00cd10af8561aa767445f5
-
SHA512
f1246928024a87893953acf96b34e1ce533444747f82fc0890b31f27920ea71c66509f7bce9c4eba465b2cf29195443d40651812244b1e9c78ed5f9e144a71b2
-
SSDEEP
98304:F+s9rk5GBXqVdfgg3gnl/IVUs1jePsqthvHrFHa7a1gg3gnl/IVUs1jePs:7k5GRIdNgl/iBiPftLIagl/iBiP
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\8b7b574925f05bf8e431e8307647cb60.exe"C:\Users\Admin\AppData\Local\Temp\8b7b574925f05bf8e431e8307647cb60.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\8b7b574925f05bf8e431e8307647cb60.exeC:\Users\Admin\AppData\Local\Temp\8b7b574925f05bf8e431e8307647cb60.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
832KB
MD5a236c0cac6699e418c026787923de5e7
SHA10d3dbf1a32e3c13b37c4eda4f155c68712006c0d
SHA2561d39cb0204b32ee43e1fce348e96f18a826d51fe523afc686a32bcf4c1e01557
SHA51206a943ff9be608aafde5eaa694318b8b69c6a25ddee8bb6a90bc9c948c7ec17d730ffb33c9c66d1de6c7042e7f375f792313797a163bcf6eabb88047e2596902
-
Filesize
2.2MB
-
Filesize
1.2MB
-
Filesize
4.9MB
-
Filesize
2.1MB
-
Filesize
2.2MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB