Analysis
-
max time kernel
143s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
18-01-2024 22:08
General
-
Target
66281139432d42f0ebc0619d768f40e0.exe
-
Size
2.9MB
-
MD5
66281139432d42f0ebc0619d768f40e0
-
SHA1
46020d9ec426161ef31e10243e55e3f93c273782
-
SHA256
35b78933aba2c43894923fc9c4859ece4b14295fbde8191c6c4fc36da2743964
-
SHA512
e88e1c1b6f4a197d3229982ea2cee7792eb400de6c0341893bf75af68d4e322751ac3a443d154bdbdaf3d61a5bbfeec55a254ec4b139b8eea70eb0ed08787ee3
-
SSDEEP
49152:GAhPv7kEvZFmhDxBgyQWpb1luGP4M338dB2IBlGuuDVUsdxxjeQZwxPYRKs:HhnAEvZFQDxjvdmGgg3gnl/IVUs1jePs
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\66281139432d42f0ebc0619d768f40e0.exe"C:\Users\Admin\AppData\Local\Temp\66281139432d42f0ebc0619d768f40e0.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\66281139432d42f0ebc0619d768f40e0.exeC:\Users\Admin\AppData\Local\Temp\66281139432d42f0ebc0619d768f40e0.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
238KB
MD558473a84a83ff4f70582a71c5b94ea7a
SHA158e3bcd75cf60c72a3dae49e55d50cb3bca8365b
SHA256c3df2fc2c573ab956123ece14d49aeb40559df7e57eb76e5b57b6949b552faac
SHA5124a6c159b2e730161c0d76df6f1634ea16f814e13793b1af28d91241b7ed7122386e6c2e9627f5857300bef02e627de1dc526f78f67f33defe30096708ede0711
-
Filesize
2.2MB
-
Filesize
1.2MB
-
Filesize
4.9MB
-
Filesize
2.1MB
-
Filesize
2.2MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB