Analysis
-
max time kernel
144s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
-
submitted
04-02-2024 08:30
General
-
Target
8eafefc41213583bd9e3a3b67615396f.exe
-
Size
1.3MB
-
MD5
8eafefc41213583bd9e3a3b67615396f
-
SHA1
517ad74319edfb9b9b04f3386990f88cd488ea6e
-
SHA256
67894dc1d42c272efc1eb09d9c79c5b9484406cd0c315f86c312f9d7f5a70209
-
SHA512
b199012bc3a80651425746a5aa0bbb1df8b1a792f9e43060f78ade467f7d018ba4429f3656a14cb995f1e413eae263477c03a941076e20f22941a7645caf4eba
-
SSDEEP
24576:TxxoGEzRjGLmib0tzd9ZdrYEfjr72QydIy9L8upUMq9iZoRxnx2BTFd/WO:TwGEzRqL1bGTdlff72QCIyZ8DX9iGRnU
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\8eafefc41213583bd9e3a3b67615396f.exe"C:\Users\Admin\AppData\Local\Temp\8eafefc41213583bd9e3a3b67615396f.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\8eafefc41213583bd9e3a3b67615396f.exeC:\Users\Admin\AppData\Local\Temp\8eafefc41213583bd9e3a3b67615396f.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
696KB
MD5c99615c999fc77a4d6b2e791f6839afa
SHA1644d8ea60e18562e34ef8780dd62cb4c79c2b91c
SHA256ed5d4975b3d1b9593ecc338e2486825c96fccf24e24a6f9289c1984e0ebb7284
SHA5129c1e6038bd252d85bfcd383d1357b167e921fb41c954ec6d7ed8e99d317ba4863c34b7a66c1e09c7e05907818447a41c56a14106825e7045abe281a1f51bc67d
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
2.1MB
-
Filesize
2.2MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB