Analysis
-
max time kernel
144s -
max time network
93s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
-
submitted
05-01-2024 06:38
General
-
Target
4302b5673580fecff89a953c8aed2c58.exe
-
Size
1.3MB
-
MD5
4302b5673580fecff89a953c8aed2c58
-
SHA1
8557239cd577ba5cda26ba99fb7d4dd87a335614
-
SHA256
fb71fc80b8902907b26fc59beb82d65b7d2f088fc8e9874ca17728326222a89d
-
SHA512
6d1a4c66913bf95a7ea96790a232e052b456d980fd43bfaf73f9f9e2d9b62ab6316e5556ffb5065ce812d16808e5d330b7daae21ff47c29d03aa8de651fd582e
-
SSDEEP
24576:eA/CVXxJej38kLISa6KAp1doiYLqYAP8nvhiSWLAhvG:ehVLeL8kLe6KcdhYv6SEL
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\4302b5673580fecff89a953c8aed2c58.exe"C:\Users\Admin\AppData\Local\Temp\4302b5673580fecff89a953c8aed2c58.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\4302b5673580fecff89a953c8aed2c58.exeC:\Users\Admin\AppData\Local\Temp\4302b5673580fecff89a953c8aed2c58.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
108KB
MD509dc6c1f27f3e7cf1d7aa92d5cc9e38d
SHA1b09b5e26bfbc67f300de16ef817bdbf37c382057
SHA2569c6c1ced8001f019ecf7f818d209c587009a0644e3f94f8d4bae28d455db0ea9
SHA512cfc5e044e8f0d297d76a4baa02a67acbdfa7c76d90e1b79e5d949e1116be03bb223ef59abcb54dfd308d4f1f12fde9563fd29442c6b5e69d547c382c4918244f
-
Filesize
1.1MB
-
Filesize
1.9MB
-
Filesize
4.4MB
-
Filesize
4.4MB
-
Filesize
1.1MB
-
Filesize
1.9MB
-
Filesize
4.4MB
-
Filesize
1.9MB