Analysis
-
max time kernel
147s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
05-01-2024 12:47
General
-
Target
43b871b5d62dd258c2e6f80e33e8f2dc.exe
-
Size
1.3MB
-
MD5
43b871b5d62dd258c2e6f80e33e8f2dc
-
SHA1
a52821481107fcdd1d261e1a01f841cd667ebd7f
-
SHA256
3f8cea70c14eced7a32438e37f40dd0fc4b397125429736fc7028f2ee513b59d
-
SHA512
27fa21a850b05f7a2481fafbaf4babdc3bed6bbd9f1d90d0a1c4612c717552d2abf768bf3284420bccf85ddb4174b0ea4d1cd58a4b7f4b2a1f6868e93e264f3b
-
SSDEEP
24576:x/4Dn0rjD+IwPu6p6ZPJuXYsAPi6YRTiEx0sGZoS6SiQQaNfkbvG:lan0/CHp6mX5APHWiEpGaS6SzQaNf
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\43b871b5d62dd258c2e6f80e33e8f2dc.exe"C:\Users\Admin\AppData\Local\Temp\43b871b5d62dd258c2e6f80e33e8f2dc.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\43b871b5d62dd258c2e6f80e33e8f2dc.exeC:\Users\Admin\AppData\Local\Temp\43b871b5d62dd258c2e6f80e33e8f2dc.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
182KB
MD5d9e71d28f7b789ed20468280c2c4c3b1
SHA19eb931daa1325b25a2710190d19ae8c291534d76
SHA2566dae02e7f1a46fa8dbed90ad72f77f7494ced0dc55adef14e52f16d5f5014192
SHA5123ef78735cbbc1feb262b9a16172c1969b27eabe22a5bce5b5bbdb770363032e9dc6f7167202bea26e059483636c5fa29cee81a9fe96a4b317d66e2ebca319ba7
-
Filesize
1.1MB
-
Filesize
4.4MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
4.4MB
-
Filesize
1.1MB
-
Filesize
4.4MB