Analysis
-
max time kernel
148s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
01-01-2024 04:49
General
-
Target
3beebafb40cdd38743c8ff821bf0c4ed.exe
-
Size
2.9MB
-
MD5
3beebafb40cdd38743c8ff821bf0c4ed
-
SHA1
25045c998a25d146aa2448ec0abb0bfff2a60083
-
SHA256
6d68d5532ad78421bfcdff044c82148d407cc4a250372242e91893d851eb9811
-
SHA512
e24c01e3b39d59d064159cb97fce81aa261b4dab0f8b6a1d5822534a5c58cc33d72220818c4eea11a841ad358f579d67a70700300f4db65d8f344c062783021c
-
SSDEEP
49152:5KhT0BNIEQ5WOCruaexNMKdI9XfdDs0TBLbQfgHxbUQV+HykoywneUNCK0:5KJ+NW5Wmaeldefd9T6gHxtVGykoyKep
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\3beebafb40cdd38743c8ff821bf0c4ed.exe"C:\Users\Admin\AppData\Local\Temp\3beebafb40cdd38743c8ff821bf0c4ed.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3beebafb40cdd38743c8ff821bf0c4ed.exeC:\Users\Admin\AppData\Local\Temp\3beebafb40cdd38743c8ff821bf0c4ed.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
375KB
MD5f14f402357b787b209c3f0269328bd86
SHA1ce5d61b3bf5bb1e8c782a41f95063a2428f1b1d7
SHA2563e8801549e9a61d2ff89cf3a9941646c6381aef0b4287b8cf37e38144d44af9b
SHA51299f6e1632cb2ffde69f9a6d171279a0235ed9aa0779a6bcbe95034b352af9624eb48eedc5642262af60ff4c8658cf6d4533c5e434f73c988ed3345fedd70fa9d
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
4.9MB
-
Filesize
2.2MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
2.1MB
-
Filesize
4.9MB