Analysis
-
max time kernel
150s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
01/01/2024, 18:09
General
-
Target
3d868fb62a491292076e708ee1d78169.exe
-
Size
2.9MB
-
MD5
3d868fb62a491292076e708ee1d78169
-
SHA1
f19c90dc5c5706587dba9219bf9a4a4c92c2a937
-
SHA256
bd38363b8933b74f10a22dcb4b446d26fb0dd04009075849258b282bf0d16b30
-
SHA512
9392b70173ee5039271bb5a348cd11f6442d5520dada77171232739e979e27c70b6b6ed1c611220164be95e52ef9aaba0d6833815bb5cd4a9556f8e82c668d1f
-
SSDEEP
49152:JOOTn9IO1yXr352o3+X+fteFfF9Baj8BBT4SfcsUjoh48TyMPkXdwkyZ:JOKyO1C5PStFHau42c1joCjMPkNwk6
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\3d868fb62a491292076e708ee1d78169.exe"C:\Users\Admin\AppData\Local\Temp\3d868fb62a491292076e708ee1d78169.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3d868fb62a491292076e708ee1d78169.exeC:\Users\Admin\AppData\Local\Temp\3d868fb62a491292076e708ee1d78169.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
65KB
MD5ee76085ef43966eb795eacaa9d5f8345
SHA19656d0467210e1d4cd4e8e3f279f423afb8876d7
SHA256eaabce5eeae62bad39f4851f426ad77cac5f2b5f6171680be4dc54dc4b07bf62
SHA51266d6e68959a749e3ceb131e28f971f6c14a8e4c26dd1a5eb460e6ec76b989f31acd07018302c56d3567f084d350590b6543611863ae69419222074a19679f8cf
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
4.9MB
-
Filesize
2.2MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
2.1MB
-
Filesize
4.9MB