Analysis
-
max time kernel
149s -
max time network
180s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
31-12-2023 04:08
General
-
Target
278a7992a0aa29b3ddb91be9c9e74378.exe
-
Size
5.3MB
-
MD5
278a7992a0aa29b3ddb91be9c9e74378
-
SHA1
8d8872b0e729a0234d8f5df66d86cfd4794107dc
-
SHA256
cc0d2cb10a5587ebb5c6fef350b7c61305d96286f08878ce090e1c8110b4997e
-
SHA512
8fdf9363a085ed4bb51589aba224d77312a168956a6572ce153bfa2678a0901b2419405ab3a072ca7d614b761f7979f70698fdc1acc3f3510630e7946d6de767
-
SSDEEP
98304:UJNWnLBxbRFrdqsNh+fMwcfR5tuPNavIrM7Y6V7isdqsNh+fMwcfR5:kWFRR1dqah+8XmNYBisdqah+8X
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\278a7992a0aa29b3ddb91be9c9e74378.exe"C:\Users\Admin\AppData\Local\Temp\278a7992a0aa29b3ddb91be9c9e74378.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\278a7992a0aa29b3ddb91be9c9e74378.exeC:\Users\Admin\AppData\Local\Temp\278a7992a0aa29b3ddb91be9c9e74378.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
767KB
MD5b0fb36dc6e77672eeace5da2d5ff80f3
SHA11c34367d50a0bca0112c9102d2c8fcf6cb749663
SHA2567fe3ec8d97a303d690350f36c3c1505a58a96dbf0c86d4c9022fdce83728f608
SHA5129866016ec67d663863f334ab461fa411e1801d301005dbbcbeea18881503f4cbf7e0ab0d049175e55672cee6bbab5aa562eef74563c1226ccac78ff4a3c27310
-
Filesize
1.9MB
-
Filesize
4.4MB
-
Filesize
1.1MB
-
Filesize
4.4MB
-
Filesize
4.4MB
-
Filesize
1.1MB
-
Filesize
1.9MB
-
Filesize
1.9MB