Analysis
-
max time kernel
149s -
max time network
179s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
08/01/2024, 05:51
General
-
Target
4a9bde5823c418b9a1f650bc15e022eb.exe
-
Size
1.3MB
-
MD5
4a9bde5823c418b9a1f650bc15e022eb
-
SHA1
b91b6a50775ad6de98c757cea46433132efacd5b
-
SHA256
24e9a80c00533fbc34b38cef3638ebc07126ac9608f0b270d7599a2c4ac57630
-
SHA512
4b785d83250f2780e8b941bd3a641ef352d66065cd3aa4c57082d86a8c3e2a1e3b234c7be9203c2fd77b0c201e185e7877b77fdf472918b5c9b27fcb42e263c4
-
SSDEEP
24576:haOu2bKYcRtnEG6twJO+1rjEvBw70aEbqKIOARdHFL1ROCRk8vvG:YQ14zEvBFAfFLLOCR
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\4a9bde5823c418b9a1f650bc15e022eb.exe"C:\Users\Admin\AppData\Local\Temp\4a9bde5823c418b9a1f650bc15e022eb.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\4a9bde5823c418b9a1f650bc15e022eb.exeC:\Users\Admin\AppData\Local\Temp\4a9bde5823c418b9a1f650bc15e022eb.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.3MB
MD50c9a4f3a9e1a2899658cd615ffcc5690
SHA196b4783f951e987cc1eb207805ff76e5ad6d3669
SHA2567fc03ad2e614f2e1ca9f8b36621bcee3c7037238c7eecb83945b6bfd594f3b3e
SHA51245ecf8c0506cdbf1899e58721ec08ed2d11693182a014fbb668023603795c6d2f9c0ce698a367234ae78d1ac2aff54ace9a29d973b14720ba2d619c46ceccbba
-
Filesize
4.4MB
-
Filesize
1.9MB
-
Filesize
1.1MB
-
Filesize
4.4MB
-
Filesize
4.4MB
-
Filesize
1.1MB
-
Filesize
1.9MB
-
Filesize
1.9MB