Analysis
-
max time kernel
145s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
-
submitted
18-01-2024 16:11
General
-
Target
6576cd124f9e5d320e6567e2702b9d8d.exe
-
Size
2.9MB
-
MD5
6576cd124f9e5d320e6567e2702b9d8d
-
SHA1
cf09d3e6711fc9fbc7b2b9adbc1f11430ed1e6e8
-
SHA256
0917e73cace00aec5b1925aff2be26b750ffa5e0b85357fae674a7197ef08545
-
SHA512
d9102e63b3cf71b8fb42f24d8b7dee64b3fc3fa7c2f15104e32bd12e59ecc1eed3b7d6fa42882ec71a7b37eb427bc6d8426cd9d0a1f22fad5e4119e6b0a4fd43
-
SSDEEP
49152:Lhk4wbh8XNWthzquloPkRaADGWacmNxC8vJ5LqpmFi38XpkMEq4:aVheNWzedsRIWgHC8bLliGSM8
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\6576cd124f9e5d320e6567e2702b9d8d.exe"C:\Users\Admin\AppData\Local\Temp\6576cd124f9e5d320e6567e2702b9d8d.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\6576cd124f9e5d320e6567e2702b9d8d.exeC:\Users\Admin\AppData\Local\Temp\6576cd124f9e5d320e6567e2702b9d8d.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
468KB
MD5a004457de8c87daefca84204cfb49008
SHA1d780bd9b8a7cfaaeec621703c9b8700afe791d79
SHA256d5b36ecccda505b57e6c7890d1f53f35a91ed4869c5a765084647b574c820be4
SHA5121b21ce84bac6277fed13b9e227a74c1b041c5e6f969a4d5c6e7de7b2fb4714a79b0b1c6994f644ccd7d3332b044226b4b38f2c1bda58ce2289ae190cec6d77eb
-
Filesize
4.9MB
-
Filesize
2.2MB
-
Filesize
1.2MB
-
Filesize
2.1MB
-
Filesize
2.2MB
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
4.9MB
-
Filesize
2.2MB
-
Filesize
2.2MB