Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
12-01-2024 20:01
General
-
Target
5760965dbc491768599a0f4a300850b6.exe
-
Size
2.7MB
-
MD5
5760965dbc491768599a0f4a300850b6
-
SHA1
c2fe02d0e49a6d42ca8a1fbba35899aa3c710c06
-
SHA256
f3abcee62eabdf75efa04202f6d322a0ebeff5a3ec7e3a5aa7a0dfb3c1e07258
-
SHA512
2c5ae07da32fc0887f25379cd319bcfb5130eb5b0c0aa18e8221c5da544a32fd3f57c9bf99b0bab0783e8b8bbe11b3fff318903e76d1bc08325c0abcbafc747e
-
SSDEEP
49152:HZRtN+WELlMP3GbQbgnnR9ktBc1+Q4YdxSChG38bDUggR9t:HfhELl+WFnHktBcwQDM2YIDULHt
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\5760965dbc491768599a0f4a300850b6.exe"C:\Users\Admin\AppData\Local\Temp\5760965dbc491768599a0f4a300850b6.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\5760965dbc491768599a0f4a300850b6.exeC:\Users\Admin\AppData\Local\Temp\5760965dbc491768599a0f4a300850b6.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.3MB
MD5f00daa8c778d6c433bd26cea50aa2712
SHA1058d74494c4e5c63b1b0a2c201f87ecdad99d2da
SHA25619eecef80c67230e919325cfab90d9f8d4e561578aba50b643a7e99a0d7e3ccb
SHA5125e8db2b61181402ca0aa2565d7d42c6545b994caaab37df757fcec723587a43d5876635c01de7e0b6f5ff5300953c63111c69606dd18ab3dce3bd03d21009e5f
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
2.1MB
-
Filesize
1.2MB
-
Filesize
2.1MB