Analysis
-
max time kernel
151s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
12-01-2024 06:36
General
-
Target
55be75e757c49a990900d5a8baedfe1a.exe
-
Size
1.3MB
-
MD5
55be75e757c49a990900d5a8baedfe1a
-
SHA1
b96142abf2220133fe75c86761e482f3f4c22059
-
SHA256
e9c5b06dec417ee2ee756035c8cdc026bf3abaeed7ca9ab73b1447f61741c7eb
-
SHA512
5c579bd359747e5ba983c6d02f49f0014eee3d4e405810e777d417e8e03d48e1254856bc228163c215feb09a8ebf584ca0b390e6c6f50288b070e2f8fdf81788
-
SSDEEP
24576:wwGkyCbfqG2eFOgFpCNJzW1GGKjCy1CyvDKkPSW9hBw59X213U9/9Us:w2vbyLUCH6U/jCy8MGk/wDX2qR9j
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\55be75e757c49a990900d5a8baedfe1a.exe"C:\Users\Admin\AppData\Local\Temp\55be75e757c49a990900d5a8baedfe1a.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\55be75e757c49a990900d5a8baedfe1a.exeC:\Users\Admin\AppData\Local\Temp\55be75e757c49a990900d5a8baedfe1a.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
61KB
MD56be325712a70dc8ba0a18994253c32be
SHA1ead8281fba0ecd1930f339203c3ee3033640bee9
SHA2560e83c58efa475517f2f29dbfdc1996e80b0b8207129ef738d19532a87dea6c51
SHA512c1557485b4c07e1f1c2bae927b4af123b3078da4af76e069f343d2f64b538b1e1e8878fd74bffefbc82636ed716c5f9067ed3c67ec47b3bb88a52359c883142c
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
1.2MB
-
Filesize
4.9MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
4.9MB