Analysis
-
max time kernel
151s -
max time network
179s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
04-01-2024 11:55
General
-
Target
40cb4cecad3e64f0f099d4dc888534b1.exe
-
Size
2.9MB
-
MD5
40cb4cecad3e64f0f099d4dc888534b1
-
SHA1
7ffa75834dbb6447d8c4d58c7a1cae578e486ba7
-
SHA256
bc0f4bd0bdd8148776e96d369e12436ce4b8828a3bb60c3b9eb082ba662c19bd
-
SHA512
ed7d4106e5098d1ceb6478e61d30506791e6ae5c4fdc2acd22ee63bad2d834d10f5a339a4713d8a6f27eee73c9d194977780ce26911b155cb1d6b264730fe2c6
-
SSDEEP
49152:fRHeTQKP6bSKBNbk1jErYc2WzryMhpxQqbrsI8OFP4M338dB2IBlGuuDVUsdxxjl:ftmP65BNCjEkc/z2tVPOFgg3gnl/IVU8
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\40cb4cecad3e64f0f099d4dc888534b1.exe"C:\Users\Admin\AppData\Local\Temp\40cb4cecad3e64f0f099d4dc888534b1.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\40cb4cecad3e64f0f099d4dc888534b1.exeC:\Users\Admin\AppData\Local\Temp\40cb4cecad3e64f0f099d4dc888534b1.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.9MB
MD523c03de5e026d7dc622a2977c7e82602
SHA1bde693fea994d30039281aeb1c44cbcfaea64dbd
SHA2566edce43671d15d367cf86942ac04b267b757cfd9a7f242ce04d3e6533a87a570
SHA5120f7e38000f39ece4c5d7865d202b3eb30a3f2f03ce483ab5a52401e3dadc79b543ee1bfac20e702a92851887904516e614b96bcd3747aa6f4f48cb749ae4cbfb
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.1MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB