Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
08-01-2024 01:00
General
-
Target
4a3bbe4e17922c17ffb1fe5c2b48245a.exe
-
Size
2.7MB
-
MD5
4a3bbe4e17922c17ffb1fe5c2b48245a
-
SHA1
bb22e3f32b79d8f04aad2821baea22ed1b5100c6
-
SHA256
26a9cded46627c18285ccbe2dbf61123e10aea8368843a12c2e2b127921bc1c2
-
SHA512
dc4dcdce8222004192523a8cabebf9e2f3a6ffb51e2cd0ae46aa1634fd47239978b1136768041eb79c9bd3acf75515f0b8dbf177210c4c559c0a8532dd98fe93
-
SSDEEP
49152:bSfzrw2K/MJparPUP+fEqxVJOh65MnREsdgR9Y5kAa1ApF14MEK/CILCVLZ9s6Bb:bigfmpM8Py7YRnusdgHY41Ar14MEK/C1
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\4a3bbe4e17922c17ffb1fe5c2b48245a.exe"C:\Users\Admin\AppData\Local\Temp\4a3bbe4e17922c17ffb1fe5c2b48245a.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\4a3bbe4e17922c17ffb1fe5c2b48245a.exeC:\Users\Admin\AppData\Local\Temp\4a3bbe4e17922c17ffb1fe5c2b48245a.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
153KB
MD5d3966e66e10ed4741181afb6218059f2
SHA1d6c2197ac49c76bf3bea5dfd1d80f160dcb1f34d
SHA2566942b80459f094d8bd31b4e704c65033610e03f2743323c241ed3eb5b5c8698d
SHA512e0910afd4f65d8ec69449c6866ad8cb24a774d2fcf86186d8cd6de4135043c8017ac73538089e51fa0996805a1e3bf8fc6ad42579bdbb3ae7a55bcdc2a0a67fa
-
Filesize
4.9MB
-
Filesize
2.1MB
-
Filesize
1.2MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
2.1MB
-
Filesize
2.1MB