Analysis
-
max time kernel
92s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
-
submitted
04/02/2024, 09:42
General
-
Target
8ed38c10044460e37a7048c429fe531f.exe
-
Size
1.3MB
-
MD5
8ed38c10044460e37a7048c429fe531f
-
SHA1
db844da292694e35643a452a59833a60cbc47a38
-
SHA256
095ecc39610b4d6a443eb61b2c1af86f7075226d248309ba78329ae474da8c1e
-
SHA512
ca08fb639c498e8a59cc32500cb2345a287ac1186e41b40d03aa0620baba3fa6a09886b97554a9d1af4ea0544a59be36a00d7c3dc89dcbd6f2f951586cf8f579
-
SSDEEP
24576:EXV3R85YVdmE4FX+6tI5QDb3uCB3h1ISwCWJkssEYewbzs4Ftvjde0ADPftU9/9j:Sayd14Z+T5QWSnWJ7HYvbrFtv2LGR9j
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\8ed38c10044460e37a7048c429fe531f.exe"C:\Users\Admin\AppData\Local\Temp\8ed38c10044460e37a7048c429fe531f.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\8ed38c10044460e37a7048c429fe531f.exeC:\Users\Admin\AppData\Local\Temp\8ed38c10044460e37a7048c429fe531f.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
66KB
MD527db9d35087a05e596e64f53283eed1e
SHA1ab9f367c862f26d9ba8d10362fe32bd2d4c1914e
SHA25668f269e41618196b52c2a27752bacf06f45174bd4423616f16aca814ade0e0cf
SHA512520a26edc48fc22cee795d0b46b6c6f2e611c518c7aa578c0798cb98d4c919f3a8455b5c7e46bd6894f03b2b42bb390093fbca75ca0123014edc5147c717cf3c
-
Filesize
4.9MB
-
Filesize
2.1MB
-
Filesize
1.2MB
-
Filesize
2.1MB
-
Filesize
1.2MB
-
Filesize
4.9MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
4.9MB