Analysis
-
max time kernel
90s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
04-02-2024 02:14
General
-
Target
8df7b06a6a5b8db03047ec519a56bfe6.exe
-
Size
1.3MB
-
MD5
8df7b06a6a5b8db03047ec519a56bfe6
-
SHA1
06f5a69dfc8d409355c5ab41d508c6001985b7f3
-
SHA256
c90339e46c15950381a1080bed1f750c76151b881e48563ca6302120f3460baf
-
SHA512
195d8ba9d54f1a351ed1887ad028b2b9e85ba93768ab7af7a915b3f1ae0b6503277a8b9642b45698151e3653acdf1b2dfa9f5b2b466ee18428a9421139a7232a
-
SSDEEP
24576:O8jlSm+y139rqU59oHUm+apySSwbLbMaYxTm9TKKPpnDOwb7p5JJ84nyzwaUU9/t:VxSmlXHXoHaGySH0rxTuTKKPpDOQ5SbD
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\8df7b06a6a5b8db03047ec519a56bfe6.exe"C:\Users\Admin\AppData\Local\Temp\8df7b06a6a5b8db03047ec519a56bfe6.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\8df7b06a6a5b8db03047ec519a56bfe6.exeC:\Users\Admin\AppData\Local\Temp\8df7b06a6a5b8db03047ec519a56bfe6.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
504KB
MD5dfc4355076cfc466b3be736174d4135f
SHA13cff61f8b167cf1b95e0bc94a5a1472e9789ba9d
SHA256afd17a09a2dcc6e2c4ba983d4f909ec6e6fbce8be8f890f561474e127c3f6423
SHA512999b36b5a0d243107dd1ff3f2fb67a34750df3477b72c1a2d7683425067f9c5bcfb36f6a049b7283c623b03b6280a4364cb9273dd3152aea038b858cbf86a054
-
Filesize
1.2MB
-
Filesize
2.1MB
-
Filesize
4.9MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
2.1MB
-
Filesize
1.2MB
-
Filesize
2.1MB