Analysis
-
max time kernel
150s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
31-12-2023 06:00
General
-
Target
2af7190681daa4e8b7aa8d6bf1f8c4c4.exe
-
Size
1.3MB
-
MD5
2af7190681daa4e8b7aa8d6bf1f8c4c4
-
SHA1
fb58c7d5c859c245c84f376bedbb25b522e5a162
-
SHA256
40bab5d000877eb27dc8395d3758ee5df4622572e1f7c07328500a0c1bd4663f
-
SHA512
29fdc1201e81b27d5226fe0923235089a5d69c82eeecbd7a305802f6dd8f8e829544a82c54036fc1a6d05e63a836fe64ce3851915b1e15299e85c4c075d2b836
-
SSDEEP
24576:HaLR3s/3BGAwM0XWF5kXEneZoNnkrLmbp1ys0vAOPfRKqlG+ET6Pg5nzhU9/9Us:H4E4eFwEneZbmbp1y4UG+M6miR9j
Score
7/10
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2af7190681daa4e8b7aa8d6bf1f8c4c4.exe"C:\Users\Admin\AppData\Local\Temp\2af7190681daa4e8b7aa8d6bf1f8c4c4.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2af7190681daa4e8b7aa8d6bf1f8c4c4.exeC:\Users\Admin\AppData\Local\Temp\2af7190681daa4e8b7aa8d6bf1f8c4c4.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
4.9MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
1.2MB
-
Filesize
2.1MB
-
Filesize
4.9MB