Analysis
-
max time kernel
143s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
04/02/2024, 14:44
General
-
Target
8f6ad221d9f64f0cc3189b55025fce89.exe
-
Size
5.8MB
-
MD5
8f6ad221d9f64f0cc3189b55025fce89
-
SHA1
4ddd8e83ef4cf0594b554f619ece9c1aedaff6a9
-
SHA256
a0c90c0941bb41c74aaa5cfae37fc4d3bcda470338c9384002066a6c8647b1b4
-
SHA512
eb16e8f0c35df89d005dd39bdab227f970159fbda6079719b62f10d59d49742742bebf5d37303f9cb53881578504542da9e19dd27e6cfb7e648bb7ed6670d582
-
SSDEEP
98304:kOkud1Xe1KGQZaXhP5a9UEI+eG9jAkbkR79D+cVItGQZaXhP5a9UEI+eG:Tde1EGhRaaCkN9qHGhRa
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\8f6ad221d9f64f0cc3189b55025fce89.exe"C:\Users\Admin\AppData\Local\Temp\8f6ad221d9f64f0cc3189b55025fce89.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\8f6ad221d9f64f0cc3189b55025fce89.exeC:\Users\Admin\AppData\Local\Temp\8f6ad221d9f64f0cc3189b55025fce89.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
225KB
MD5b8311bc7cb0afa535491ed48fffb6e82
SHA1d082e1198515ead9376d28ece15055e4e7e4afab
SHA256af09ea0e4be608d3a36a53a8154a6ba77abe016ed1852bb3a65647d980cb9387
SHA512f9b8c518fa30fe0e297772a46a46e4beeb387472908a1f4d695a5c3d2793d1912c4cbfbf3520d9f8970751e7ea15dd32b59d5f44fccbe7ffb6a5d08a7530c4a7
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
4.9MB
-
Filesize
2.2MB
-
Filesize
1.2MB
-
Filesize
2.1MB
-
Filesize
2.2MB
-
Filesize
4.9MB