Analysis
-
max time kernel
90s -
max time network
112s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
04-02-2024 04:10
General
-
Target
8e2ec988a4f680a246db7f28aa50dddf.exe
-
Size
1.5MB
-
MD5
8e2ec988a4f680a246db7f28aa50dddf
-
SHA1
25a41b951ff5f6752952c3ea5e721ea6fae0b119
-
SHA256
7eb3424fbd9348ec49ba754b03f1c3810bd2f5b39c047646d161747be48023d3
-
SHA512
d8f70af906bdc0a5fcc0d25eb2238a8bae56391c1a5a19b05a68ab40d869cc48b1f04c295a6843615e49b70610aab38994b791f9440290b1e63d382da875acac
-
SSDEEP
24576:YxpUW1KxrEF8QwEqKl0rYZ5MYbUVJtgXNpN67Sw0G+wcextGpPkXWW:YxWW1KxAFtsKWrYZ5FbLs77hc9oW
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\8e2ec988a4f680a246db7f28aa50dddf.exe"C:\Users\Admin\AppData\Local\Temp\8e2ec988a4f680a246db7f28aa50dddf.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\8e2ec988a4f680a246db7f28aa50dddf.exeC:\Users\Admin\AppData\Local\Temp\8e2ec988a4f680a246db7f28aa50dddf.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
165KB
MD5f8b444ceeb88705150930cad8f431f43
SHA129ce0cbebd05c5b888ac60c76d6bb0bb92e050c9
SHA25666f9b838f3cd6e21169f3f1f168a6b8cfc905b6971c06be94f1c1b338087a5c2
SHA5122a4ab25b207cab7f23a315a5c097ee6d5aae7cb525fab4d187f21fb64115387341e8c82a3977f24567a97e1f89665b26cd8b385cc944c6edf297eec14eb64a20
-
Filesize
1.2MB
-
Filesize
4.9MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.1MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB