Analysis
-
max time kernel
89s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
03-02-2024 08:36
General
-
Target
8be1dd1d395d50db5f014769ef0ed6c9.exe
-
Size
1.3MB
-
MD5
8be1dd1d395d50db5f014769ef0ed6c9
-
SHA1
04cbc40c25f9909d32b063cd4d52f82b63018f33
-
SHA256
a7493558deb1e462e7fbcb15a657ea3b1a2309cbb1db35a420c8f1eda04660ec
-
SHA512
735bdf315a3db388565f6d7233f1c63fbbf5425063de91ba5eedceae6eda03f28e99dee20b26d5c82f8dea027c0d252974a31942e9be62c8683507a0bc121284
-
SSDEEP
24576:eNnxuTG7ei8wOlna3Jt3zV0vErfc+j/C8+K7l5/TbRYhEQWc:+xuTGyqO8zSvifcIDv558p
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\8be1dd1d395d50db5f014769ef0ed6c9.exe"C:\Users\Admin\AppData\Local\Temp\8be1dd1d395d50db5f014769ef0ed6c9.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\8be1dd1d395d50db5f014769ef0ed6c9.exeC:\Users\Admin\AppData\Local\Temp\8be1dd1d395d50db5f014769ef0ed6c9.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
363KB
MD50bd91330f8d4e697a10d2a2122de00ae
SHA14286ff5a9c34159d55eb811aa6b3841093bb9fe1
SHA256387d0557aa162d191edd78d0b93ad4dae1270325c09ec4edcc78a55aab41670f
SHA51200d609ca06c03b609964bb7d5c24756a676fd079a13cb4e940e7474dde213c223023e6ab410f5b28151a4dd5efeda308860605deb60cccd0752228ce8c707028
-
Filesize
4.9MB
-
Filesize
2.2MB
-
Filesize
1.2MB
-
Filesize
2.1MB
-
Filesize
2.2MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB