Analysis
-
max time kernel
151s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
06/01/2024, 02:58
General
-
Target
4518d7953de419f0ab5d9311e8162e3d.exe
-
Size
5.3MB
-
MD5
4518d7953de419f0ab5d9311e8162e3d
-
SHA1
b01ec76fc162ae7ac60978e49e8fdd1e1d2a2ec5
-
SHA256
9a9476717a2b82f3fe4b97a4064082479ec455968510b2e7b461d005a61ea8d8
-
SHA512
760a5417f653d5e23b5518b962e2b641aaca2147ae5d122c24b3466b28f2699d6e00d16b70aa21133f95dcaf2471924c0b9e3ec6213ef94e0a1a0fdbf545aed5
-
SSDEEP
98304:O/wBVLHWbOSPv64i956mSLMW7QRYZwuSPv64i956mSLMW:O4TSOSPv64i95HAMQQRYXSPv64i95HAM
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\4518d7953de419f0ab5d9311e8162e3d.exe"C:\Users\Admin\AppData\Local\Temp\4518d7953de419f0ab5d9311e8162e3d.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\4518d7953de419f0ab5d9311e8162e3d.exeC:\Users\Admin\AppData\Local\Temp\4518d7953de419f0ab5d9311e8162e3d.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
87KB
MD5fb1238a22e391b3b0915bc45d08a09e0
SHA15a313100472b4659f102ed3b48287c6b86dc9831
SHA256fb7c55dca240cd5a88cea920fdbfe350cf2fa92fbe5455966e4d984559a6023d
SHA5122d25ddb7e8681757926219da7ed46f5c3914d666fbb9793cb7424bae0d898398f8ff198e7669f248c9a0fcf84f532af26bb755d6b14749386501105b818deecd
-
Filesize
4.4MB
-
Filesize
1.1MB
-
Filesize
1.9MB
-
Filesize
4.4MB
-
Filesize
4.4MB
-
Filesize
1.1MB
-
Filesize
1.9MB
-
Filesize
1.9MB