Analysis
-
max time kernel
90s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
-
submitted
04/12/2022, 08:25
General
-
Target
a846943e7de98b45e0377ef230f0e0756295077ccea75f8cf53f7bb858c8f437.exe
-
Size
4.0MB
-
MD5
5ac6269cba718dcdce2c8ff44698e180
-
SHA1
8c25836614077a628682787f6b57807acefce5f3
-
SHA256
a846943e7de98b45e0377ef230f0e0756295077ccea75f8cf53f7bb858c8f437
-
SHA512
ee698d922e967f9b4836184ab340576c1c0a2e29ad6c9abfecb9bdb4a429305c0681df1c3167e50547e2fd23bda7105f3cb3ab2f1c39b84342bbb797d45e6574
-
SSDEEP
98304:qwLx7Y6GK4sZLgeSnyL1GEPnXlxrPe373zHEA6KE3hfb:3DGiL4y5JPVJD
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a846943e7de98b45e0377ef230f0e0756295077ccea75f8cf53f7bb858c8f437.exe"C:\Users\Admin\AppData\Local\Temp\a846943e7de98b45e0377ef230f0e0756295077ccea75f8cf53f7bb858c8f437.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Thinstall\Easy GIF Animator 4.8 Pro\4000002e100002i\gifan.exe"C:\Users\Admin\AppData\Roaming\Thinstall\Easy GIF Animator 4.8 Pro\4000002e100002i\gifan.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
7KB
MD5000557df6ba69953864587764a542329
SHA136993ec25ead03f0d41ad633c3ec647e4947746c
SHA256970ab75636ef14bbcf737a4e9295e417814caf98ac254e50e054e8a0b9da3dc2
SHA512ce2d174a8f3cea5f4ae43d911ea601507d7046948271ea5ae50c031f206aaaa53245043cc09163587f9c246741dd45a2c345b9c4e0d32664babe6fccb0937205
-
Filesize
7KB
MD5000557df6ba69953864587764a542329
SHA136993ec25ead03f0d41ad633c3ec647e4947746c
SHA256970ab75636ef14bbcf737a4e9295e417814caf98ac254e50e054e8a0b9da3dc2
SHA512ce2d174a8f3cea5f4ae43d911ea601507d7046948271ea5ae50c031f206aaaa53245043cc09163587f9c246741dd45a2c345b9c4e0d32664babe6fccb0937205
-
Filesize
36B
MD5dd2561d40402e10b5b39c41de01cb98c
SHA169e8d53311f190fe8bbb89716c4f3efffaae3736
SHA25691adcf38d19f8a71eea238e89002df60d6929788b0ccb15c0e1356611d56299e
SHA51284d7ea543cf8402a15a8e8e86b04610ab4e2e9d5c5c1e28b99bd65c3985df99d5c2a30373c1d23e476c41e4c2c5d48f1e7216a355742f9d4396feaaa0c788938
-
Filesize
4KB
MD5274106cabc769592c0cc4d510f00d299
SHA164227177b5513de8dc008ace14349a95fb093745
SHA2565b8dbb6321e4a7f80c531b6edba92f1c21c07239c00badf491f628a244b0e82b
SHA512e7164c6d7f30214d297aadac596eb0147160f0ed5d1fae0f7eb2b42431c021df3315c2d434ccf39a48b348dbdd7029596f6932687f9f3c88eb54fed414a10a8c
-
Filesize
2.9MB
-
Filesize
1.5MB
-
Filesize
2.9MB
-
Filesize
64KB
-
Filesize
2.9MB
-
Filesize
2.9MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
2.9MB
-
Filesize
64KB
-
Filesize
1.5MB
-
Filesize
1.5MB