Analysis
-
max time kernel
142s -
max time network
180s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
10/01/2024, 09:36
General
-
Target
5037818918d954a31f11977df6e82a38.exe
-
Size
1.5MB
-
MD5
5037818918d954a31f11977df6e82a38
-
SHA1
3d0f10335755eb003d8740acfca87e7a53cdeb1c
-
SHA256
6fc7f2413fc1a2d6dfac54ec931da9a06397e014f4091a2e5a2919fccbc070a0
-
SHA512
2a53c2bd9996cb44dc4e6716af842bc6b98b15f894206f88509115da7e50c0e76fcf912aecff1b30f842d4f2962149e05613f69910b49e546724944cf267ba03
-
SSDEEP
24576:QURR2unqRTQkGEpx52APDZlrN5bTkgUs7Vu+0qUWVCVe7mGar9OR5RTQruiW:QcEuqR8kPm+ZNN5wgd7Vu+0OVCsKGi9h
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\5037818918d954a31f11977df6e82a38.exe"C:\Users\Admin\AppData\Local\Temp\5037818918d954a31f11977df6e82a38.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\5037818918d954a31f11977df6e82a38.exeC:\Users\Admin\AppData\Local\Temp\5037818918d954a31f11977df6e82a38.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.5MB
MD533fea963d14379bcd08412c549afdee6
SHA1466fd2c99438f3b01063c5288bce74ad02b961f1
SHA256b5ecacc244d48313bee0fb9779f930ad6226de8fddd80996abb49b3731aa5dfb
SHA512fb1540eff72abb8f7bf2c20502dfb98da7127b6c83eedd26974f6f2a9ab4f56fc450f4c3d3b2b69643238b941f9346f3a03279f3e9c4a763f499b2291ec26e85
-
Filesize
4.9MB
-
Filesize
2.2MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
2.1MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB