Analysis
-
max time kernel
129s -
max time network
190s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
31/12/2023, 06:09
General
-
Target
2b40763ffefd0c953d638767e2ba6f79.exe
-
Size
1.3MB
-
MD5
2b40763ffefd0c953d638767e2ba6f79
-
SHA1
2fd2974ba33f4f5937d08b8d6ab73f8eed8fb555
-
SHA256
4a3543a472f5160ffc6a099527cb42fc9648e04b0599cd3123086d8444184bd6
-
SHA512
1595382a0818d83c8b9ced56a83ee5e7e628fe8c350882f93423ed84f1c36c029eabe6ebea9528541e68de6b473126029d9dbb0b410a542f7bc206afa48a74b5
-
SSDEEP
24576:8H+Wsz2tX5kR29VwVWlkOioxz7PBqCvPwBZ7SQogwY8c1hdaQphIPU9/9Us:8H+W42tJ36cRZ7pRwBYAf1LfR9j
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2b40763ffefd0c953d638767e2ba6f79.exe"C:\Users\Admin\AppData\Local\Temp\2b40763ffefd0c953d638767e2ba6f79.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2b40763ffefd0c953d638767e2ba6f79.exeC:\Users\Admin\AppData\Local\Temp\2b40763ffefd0c953d638767e2ba6f79.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
100KB
MD569dadbedb154d91ee92bdca1e6d90dd9
SHA1b8234f7336e8fceacd7a7b1556a99bc6399175ad
SHA25660b85e18cb3ecd4a28a50c8d79affc35b5ec12469865051f54cef3dca8c7316c
SHA51290fbbd19ea226b03bfc333c8394d4252663f0b71248242bf4f665b9af9dfc54a76206fe3618568d9743cac1c54008b780f39bcb531de33234663386411f29a9a
-
Filesize
4.9MB
-
Filesize
2.1MB
-
Filesize
1.2MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
2.1MB
-
Filesize
2.1MB