Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
14/01/2024, 01:16
General
-
Target
59e49e3b038607a14661ac42049e6519.exe
-
Size
1.3MB
-
MD5
59e49e3b038607a14661ac42049e6519
-
SHA1
9e1e61938de8e990ab08f554556f741b564ce881
-
SHA256
d46b7519480fd60331e5c7323616af272aeab058376f6aa1887d8b43ad09a672
-
SHA512
39fd896fe5182f9533136f1a0627c1b421661ab2353f763f59fed97029fe136dc6a988f83c0881452284bf385c15e72b3b1ae14e77e73fd4d9a62e26ab3a8dbb
-
SSDEEP
24576:wO6/42tHC+eKseqqV9iXn8CYjOgcybsPfceRZj0dbFxMR5lb5WO:wO0tHC1KH/WGzcybmfce7jSW5f
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\59e49e3b038607a14661ac42049e6519.exe"C:\Users\Admin\AppData\Local\Temp\59e49e3b038607a14661ac42049e6519.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\59e49e3b038607a14661ac42049e6519.exeC:\Users\Admin\AppData\Local\Temp\59e49e3b038607a14661ac42049e6519.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
209KB
MD5ac1a82ebfb464fd3a7a3ea0296f7fa33
SHA145a7ed280dce447cd9d0afafa06bc2ef8687b553
SHA25687b84a7745705560ba332564565c632ba4ac2d252e366aadb9382607ab9876af
SHA5127285670570f452168845e92a1198ca233b663241d793ad0086aa0e7b22c424fe225c446db49bd4945f8e375667968144eefb2f554bec87ec498a95517b2492d7
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.1MB
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
4.9MB