Analysis
-
max time kernel
93s -
max time network
112s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
03/02/2024, 07:35
General
-
Target
8bc389d06c2cf35b673dac3c1edf08c7.exe
-
Size
5.8MB
-
MD5
8bc389d06c2cf35b673dac3c1edf08c7
-
SHA1
1c264ebd376244eea084727f71fd4c79a48815ab
-
SHA256
ef5a1fb1b7ebc7a9c65d2f9593d52e369c8f3d59fa5b48eb9b5d31ded5e49c42
-
SHA512
e9a152043d4de53a636fe8424f0635f320a2cf3ea29a7854ed0509b41e8654ce613ee5b21d11e77c2d9d3dfa2edb85dd477b7b008fdc4822a909504fcb685f5f
-
SSDEEP
98304:TQKBj7xylOV6F9nrHau42c1joCjMPkNwk6alDAqD7z3uboHau42c1joCjMPkNwk6:cKBjklOV897auq1jI86FA7y2auq1jI86
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\8bc389d06c2cf35b673dac3c1edf08c7.exe"C:\Users\Admin\AppData\Local\Temp\8bc389d06c2cf35b673dac3c1edf08c7.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\8bc389d06c2cf35b673dac3c1edf08c7.exeC:\Users\Admin\AppData\Local\Temp\8bc389d06c2cf35b673dac3c1edf08c7.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
405KB
MD5e453c9719a11ee11b07418f91b69b81a
SHA1bc0befd6419ecbbb441756fc18968035411cef1b
SHA256d4381ef2d9170ca3b2de7a696560ddaacd11fd4b713fa9ecaffaa1c7c2f3898f
SHA512b93b7cadee2e69f54e2c5bb23373aff2ff15f63eaab16072b841a778a596df0838928100ca0fffea5e3e5aa1c913b7113519a3b46ea6b395d874eaa8994fc1f9
-
Filesize
4.9MB
-
Filesize
2.2MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
2.1MB
-
Filesize
2.2MB
-
Filesize
4.9MB