Analysis
-
max time kernel
171s -
max time network
186s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
01/01/2024, 15:36
General
-
Target
3d3b1e51834b5479bf4d0efac434b8a4.exe
-
Size
1.5MB
-
MD5
3d3b1e51834b5479bf4d0efac434b8a4
-
SHA1
822ff2b282f2fe55d34e620feef5b8d57edbc46c
-
SHA256
81228dbae7982552e8d34dcc0f938bfb00b187a7593cebaf124ae4ba4a25c2c7
-
SHA512
c68822c4e3e6de164acc74455ee7624a1fcf58cef0cdf85798180ef7e0f2baf4be22e1bd1d6b81c23cc1cd4cba4a539cc52d10d44d0419718ecdcbc497415ee1
-
SSDEEP
24576:Ae0XCbaaHEiTLZoKWY80J3XnT9VQGVU0FqWjLk4P7v9H7MLW:QCmWvZ6I3DgGVUAAwe
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\3d3b1e51834b5479bf4d0efac434b8a4.exe"C:\Users\Admin\AppData\Local\Temp\3d3b1e51834b5479bf4d0efac434b8a4.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3d3b1e51834b5479bf4d0efac434b8a4.exeC:\Users\Admin\AppData\Local\Temp\3d3b1e51834b5479bf4d0efac434b8a4.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.5MB
MD57e38909558ecddbba89a4d3b5a1280b9
SHA13e970402e720bffc08eda33bdc84327b8c06c1f7
SHA256e75049ab9bf1714ce5046dc15b4c2dba6148d1984204a6b5bbecafb041c97e45
SHA512f38dda78e64de3374fd95b125b502363f47988c8d5c3d229d46089cce00dbf01b5cf5b76dafa8fb67dc36bf90f54a2feff5607534cc44241a156abef7d77045a
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
2.1MB
-
Filesize
4.9MB