Analysis
-
max time kernel
145s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
07/01/2024, 20:38
General
-
Target
49b4eda698b8a12d51a8a85e5c789d11.exe
-
Size
2.9MB
-
MD5
49b4eda698b8a12d51a8a85e5c789d11
-
SHA1
051dac05fbe131f058dc9f549bdf3e0750005d60
-
SHA256
d14909068ddb84a9bb103c59ca862e22057b88ef6bec2ca1d43d113c720ba748
-
SHA512
bdf02d19963166e111f0b8fa940280056e31f481148f9138b4aba024d25de01abdae3dd524bfd4f4102567882053185d8136cb7166bc708559c7b614b60c797b
-
SSDEEP
49152:rp/hZOIBhL/3HpzKcaEFAoNdGP4M338dB2IBlGuuDVUsdxxjeQZwxPYRKs:rt7JmcbACdGgg3gnl/IVUs1jePs
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\49b4eda698b8a12d51a8a85e5c789d11.exe"C:\Users\Admin\AppData\Local\Temp\49b4eda698b8a12d51a8a85e5c789d11.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\49b4eda698b8a12d51a8a85e5c789d11.exeC:\Users\Admin\AppData\Local\Temp\49b4eda698b8a12d51a8a85e5c789d11.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.9MB
MD5c1f029c93e7da6f95f7a96dac5764996
SHA17160f6acc4e4d36c7f1513dd01299402be7007dd
SHA2563e8b96d97cc0fa588753862c2814640fc7c8258ee49f9849f097a57854bc7b12
SHA512c5ef8a3c4f7744547384c33e04f0e02202b1e069b757ce83f90d1c19b3cc2d2d792207cd3511d5335a9ec2190a50bcd066f1b5a92070155d41c1d119dfe32f99
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
2.1MB
-
Filesize
2.2MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB