Analysis
-
max time kernel
195s -
max time network
210s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
04/01/2024, 12:52
General
-
Target
40e8f680ed165297210da70d5cda5e07.exe
-
Size
11.7MB
-
MD5
40e8f680ed165297210da70d5cda5e07
-
SHA1
44209aba6267bbdafd30444c91cca7b41e7af855
-
SHA256
ac9f72d1e7eb6ab817a8df4f2831b4f61cf3553191b5f0520aeb91d4725ef6e9
-
SHA512
d0f424c9edacfafa6505379f9d65d38a119ab2df31407b9c401ef39d78a9904985beae377da61cc8737ed360be99483d9e68d8a7c112b3ea3012d1e98c59f709
-
SSDEEP
196608:OpWGqP3X5Q1gl/iBiPiogl/iBiP35PHy6gUgl/iBiPiogl/iBiP:OpK3JQ12i5o2iwy6gU2i5o2i
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\40e8f680ed165297210da70d5cda5e07.exe"C:\Users\Admin\AppData\Local\Temp\40e8f680ed165297210da70d5cda5e07.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\40e8f680ed165297210da70d5cda5e07.exeC:\Users\Admin\AppData\Local\Temp\40e8f680ed165297210da70d5cda5e07.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
328KB
MD52a0f1f9292c3ad2acf694ea9d2378b6e
SHA1f9d28c1f43faaf415a6b36d770f70268d88d3868
SHA256743cf3d52913e918672e0aef0d82878da3f910722a1d62040e6f5ca0eaa5f59a
SHA5124c754a2991b3b67bfa65f65f2b17d00144284d630f134831abf5d84f2ebbf58566fbccfe76b71e511870b07f8337e5a70e1a4a73ae07528dfc730b04ea7723b3
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.1MB
-
Filesize
4.9MB