Analysis
-
max time kernel
139s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
08-01-2024 14:18
General
-
Target
4ba9634c6eb235ed57927d249bb90809.exe
-
Size
5.3MB
-
MD5
4ba9634c6eb235ed57927d249bb90809
-
SHA1
1f3bcdf3782625a212fe3ef327bc9740251f89f0
-
SHA256
12c42c54994549fa1417e0c8db5efc1201e240f414982dab75b768a3f8212ef8
-
SHA512
c4e087537dc6de92210226f5878fa190969ff56e45b69bd9d1e2a9b89f4cb8790df23b35343bbcec77d74f5c182cfaf6b839bd514c262e945bb3edd7fb9e56f5
-
SSDEEP
98304:/DSC3Ak8SHwFLJhOhEsutSNsHAcXc8mL/X+jHwFLJhOhEsutSNsHj:rSXSwnOfunLmL/X6wnOfunD
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\4ba9634c6eb235ed57927d249bb90809.exe"C:\Users\Admin\AppData\Local\Temp\4ba9634c6eb235ed57927d249bb90809.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\4ba9634c6eb235ed57927d249bb90809.exeC:\Users\Admin\AppData\Local\Temp\4ba9634c6eb235ed57927d249bb90809.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
655KB
MD54f720814a24e2f87aa82f226f38a9db2
SHA1a25a97f3ab9034f024ad5c7b30fc850d857afa7f
SHA2568f72834169edc0de0d5a0f629ea16276122537f22d7d8a066bb69cca3321b7e6
SHA51255d5e441a0498162ae0b7fc1b00082a5bba394a07481b0f551c76d62b90203d4f9c399c16e95b0846569a22e3aa0fbeadae72281cb4573423825dad39525fc52
-
Filesize
2.1MB
-
Filesize
1.2MB
-
Filesize
4.9MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
2.1MB
-
Filesize
2.1MB