Analysis
-
max time kernel
145s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
08/01/2024, 12:23
General
-
Target
4b6d6b6c98fe55b514b042fc1b2d1387.exe
-
Size
59KB
-
MD5
4b6d6b6c98fe55b514b042fc1b2d1387
-
SHA1
d5d67bedf986f74e54c7b3b1a8ac1c7f3cb1c1eb
-
SHA256
7a841d0451ac82cc5afcac7ee1c39bab46a5357c62017ee469b7cfc0f7a75a14
-
SHA512
47eea89edd886b978afd749dabe49f99ddd0329606740b1198dfc22de85459fa89a49f8a5ff23c9989163ff2fdc7a0991b0023dcf5a011d2c370cd31a11b96ab
-
SSDEEP
1536:NkPhWe6To4xXQrCrxT/k8N3ZnJcf5s8iZv86zC:NkP83TDgrCrt/kypnqKJj
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\4b6d6b6c98fe55b514b042fc1b2d1387.exe"C:\Users\Admin\AppData\Local\Temp\4b6d6b6c98fe55b514b042fc1b2d1387.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\4b6d6b6c98fe55b514b042fc1b2d1387.exeC:\Users\Admin\AppData\Local\Temp\4b6d6b6c98fe55b514b042fc1b2d1387.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
59KB
MD548b6674fb0e0698806968c2f6c66242a
SHA14fd8709be2c4bb24b18d5a1b593cc04a04aba0f5
SHA256ae6b769247abad781251eb2e9b84c95d7e60ac846832bcbda9eeab6eae0b073e
SHA512599213e1fe180f9d16960845135650cd707c8cba25cc2c76c3b1569dfcb558608ad93b18a95342fee14cfef13dea1c2271ff7ceafe188f5b1118c9bccb23f42d
-
Filesize
244KB
-
Filesize
60KB
-
Filesize
116KB
-
Filesize
116KB
-
Filesize
244KB
-
Filesize
60KB
-
Filesize
116KB
-
Filesize
56KB
-
Filesize
116KB
-
Filesize
244KB