Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
12-01-2024 10:10
General
-
Target
562be401fe139c44bc66f07c1bffa5bd.exe
-
Size
2.9MB
-
MD5
562be401fe139c44bc66f07c1bffa5bd
-
SHA1
bd5978066b91a0d74e5b889387c455e60dbc72a6
-
SHA256
f3f87736fcf9ac05ab90a3a6586995d3f60e80f388c7920586a6c9b271aae316
-
SHA512
9565b337eb6b3494a5c221fd69dcd1cafdce10be492207a50902c6b73959317d65a4f73a096294d2b2271758a52f3f06e646f28915b6bfb7777a39b5fc505c85
-
SSDEEP
49152:Qk21E9W2c+8JmdW5JNN4OCTY2nS4QAZnoE9Baj8BBT4SfcsUjoh48TyMPkXdwkyZ:lW2P8JmOuDUf4fZnoEHau42c1joCjMP3
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\562be401fe139c44bc66f07c1bffa5bd.exe"C:\Users\Admin\AppData\Local\Temp\562be401fe139c44bc66f07c1bffa5bd.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\562be401fe139c44bc66f07c1bffa5bd.exeC:\Users\Admin\AppData\Local\Temp\562be401fe139c44bc66f07c1bffa5bd.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.9MB
MD55f0861d6ac04defb660a5e6f7ace3d7a
SHA1a3bed708ac813fa8850644494bf3e25b3f073555
SHA25618e914280cd18b10b5dc8c48103907a295a5d826f659add8bc4d848ce8334fc9
SHA512a61f6b154e65b70a5a47145de5251d910f67724082b5ffb7b614bf59ef53575b49e7a1a0579331759f54c73bdb9ed76c7ab053312061a1b012930f63ccf3f82f
-
Filesize
4.9MB
-
Filesize
2.2MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
2.1MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB