Analysis
-
max time kernel
144s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
-
submitted
12-01-2024 14:52
General
-
Target
56c22b049c955d318614644c11415e19.exe
-
Size
2.7MB
-
MD5
56c22b049c955d318614644c11415e19
-
SHA1
6d54270a7e211abda3667f9c94512d7b4f6437d0
-
SHA256
4db44647eade7afd17961e63e7f8afe59ee5b6e4196584fceefc7549b63cda11
-
SHA512
2746b831a5924a7db7ea0e473c6114eea5318d2e9ccb8460c1c4f422b5b387d61736b967576ef4ba6a312e08f8dc8f3887ae0b8629df240cba730955005e6e7b
-
SSDEEP
49152:BZTKEZjgdcdL/4jgZ4QrR9ktBc1+Q4YdxSChG38bDUggR9t:DdZjgdoLg2HktBcwQDM2YIDULHt
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\56c22b049c955d318614644c11415e19.exe"C:\Users\Admin\AppData\Local\Temp\56c22b049c955d318614644c11415e19.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\56c22b049c955d318614644c11415e19.exeC:\Users\Admin\AppData\Local\Temp\56c22b049c955d318614644c11415e19.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
787KB
MD591c2e980c6a5b68c56df4f21a1dcde63
SHA1d663038017096e0d3b92a30e1b8853ec737e3bd8
SHA256f8650c3e9f84de067b014364c6de225756a934beb55f34b37a85fbb84aef04d0
SHA5129add1d2baae502d0a4c15b45d700c8dcf9e5ba243a9b5ad5c5db29fece5f1518bbd902e83d09354f2dbb1a180fb5e32f2a31b7d08480816d9c602b103985bb01
-
Filesize
2.1MB
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
2.1MB
-
Filesize
2.1MB