Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
14-01-2024 00:54
General
-
Target
59d9d3426c38f1cff329800a24cc5430.exe
-
Size
3.9MB
-
MD5
59d9d3426c38f1cff329800a24cc5430
-
SHA1
671254f127858e9c7ff714b4cb12f8c0b8e691a6
-
SHA256
deb12ee542e8ee85256f476c60031ce04b26d884481b9be3df4479128516df1f
-
SHA512
b6295a13ede87063e61fce071b288b85d469f81742ab5f70a85499503e5284b618c099dbdf1c0bb7b588e13af56eb1dafeffa55a85e5439c4ab939aa5e707960
-
SSDEEP
98304:R7kcUldE1UPbMcWEWzvgg3gnl/IVUt4pJWzZtIygg3gnl/IVUV:VkcUldBYjgl/iwgWttJgl/iG
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\59d9d3426c38f1cff329800a24cc5430.exe"C:\Users\Admin\AppData\Local\Temp\59d9d3426c38f1cff329800a24cc5430.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\59d9d3426c38f1cff329800a24cc5430.exeC:\Users\Admin\AppData\Local\Temp\59d9d3426c38f1cff329800a24cc5430.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
521KB
MD5830cb3876f7e93e90b752c18b7f8f812
SHA1544a7d6670aa1b62e1a01fe71ec4a742ccaa82c1
SHA2565ea3ae8261ab4d48f23cf294cb7c338e2551abdcfcd580f8131ad22da89ec792
SHA512f9649af62e7ee598afb22855d3eb4d72ea8106b74b9ae69ba47d07b50eb24478ef4438d7dadd127e5f01f32910f171d4d3c755826d40b9f6e74194f39da12c98
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
2.1MB
-
Filesize
2.2MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB