Analysis
-
max time kernel
146s -
max time network
114s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
-
submitted
08/01/2024, 08:54
General
-
Target
4afe2a8ab72f1eab302461c83ec1e606.exe
-
Size
2.9MB
-
MD5
4afe2a8ab72f1eab302461c83ec1e606
-
SHA1
5a041fbe619cc434b6f9b7f422eb8d53da3f274e
-
SHA256
a2791d5e29b0aa578407d2d64bac0c98efaf78de8f9e01de9f8ecf5636e2c7ee
-
SHA512
787bd6dad6b4ec27b966543fdc51fee3ff914930b5cd775add2ddc7de576b5a586eae3c90ab40c24c07c8dc8b2bc7a478f16c49816baf458ee919ece8c5820ac
-
SSDEEP
49152:/lN1j6iQoap1FHaCMWnuEG36xt+pob5DSP4M338dB2IBlGuuDVUsdxxjeQZwxPY1:1jzOp1F6CMo/ogg3gnl/IVUs1jePs
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\4afe2a8ab72f1eab302461c83ec1e606.exe"C:\Users\Admin\AppData\Local\Temp\4afe2a8ab72f1eab302461c83ec1e606.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\4afe2a8ab72f1eab302461c83ec1e606.exeC:\Users\Admin\AppData\Local\Temp\4afe2a8ab72f1eab302461c83ec1e606.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
85KB
MD57fe0596799b40830afaca24e3583c0ba
SHA1c9bee8c79b501d44f7a93c7ab36bd25bbb1cff26
SHA2564beb339483ae4eb1276107b97ec2ce9c62ece1a80f06c3532dc67d081caea989
SHA5121e9233930f14889d4baffaf9db6df634c0faf5d3ed88e6d1b190decfdd1729411b67c49a7676025f056daa486857d8d403745da272c55ebd5a698431cf8b7d28
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
2.1MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB