Analysis
-
max time kernel
151s -
max time network
179s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
07-01-2024 05:55
General
-
Target
4833c7521d836565edc4d5a2dd5a7b3c.exe
-
Size
2.7MB
-
MD5
4833c7521d836565edc4d5a2dd5a7b3c
-
SHA1
95a687c25147ef02809a1ea3fc33e5978e595305
-
SHA256
a36897f495370050926beca0a261fe74d6c3e78ebdd6a066fed6ed9a535c8f64
-
SHA512
e9f78622c0711bcc17831280ea8151ee2e08da9d06b852e4ed29af8de66a5e565fa9b82fef4838b71eb276362568970f72580eb60c51d5fca08d0642f985a8b8
-
SSDEEP
49152:0/diYDHv6Wrj38mr220svurdSyKWwkHkETaYSONmqMQOwBcfp:01tHxrL8mr220svurNKBkHPR7NtvOw2B
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\4833c7521d836565edc4d5a2dd5a7b3c.exe"C:\Users\Admin\AppData\Local\Temp\4833c7521d836565edc4d5a2dd5a7b3c.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\4833c7521d836565edc4d5a2dd5a7b3c.exeC:\Users\Admin\AppData\Local\Temp\4833c7521d836565edc4d5a2dd5a7b3c.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.7MB
MD533d698b882a182a9502828ea292b4d90
SHA17d9ed43783846d3e4e984ae7ed711e8d0492d022
SHA2563b27d26d0a4df6073899bc49900204efc49964881bfb7ad1b73e7fdf2479d616
SHA512caf80551437b2b8632f1cf3b3a8deed223aaccbb596c364dc2397c59364f92a2fc82a2c9eb9ee027be817553e4f0be0a7266f2e3ba79d658c45c1a7f72d240e6
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
4.9MB
-
Filesize
2.2MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
2.1MB
-
Filesize
4.9MB