Analysis
-
max time kernel
142s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
19/01/2024, 14:23
General
-
Target
67d7d275e4fbb12b38fff91a3f4dda02.exe
-
Size
1.3MB
-
MD5
67d7d275e4fbb12b38fff91a3f4dda02
-
SHA1
93e1f6d22115cecaa3c1164f77daa8e7c98f85a8
-
SHA256
9e2fd8dd58ed3f32aefbafbcb45dd29bd2156548bb80c9af93c5a6c98f06f7d1
-
SHA512
ecfb4958afd2d8fc8efd0099c912ec60b1ac872043a475b98878e9810781ca6412f6e456bb87a44a4f3a4329ba78704d9c1307acbeee08657fa45ad6c48eaf28
-
SSDEEP
24576:wgW3YJQ+I95eZQiYj8J8JyoxwZuBIsOGeIQxORGY5pLtqxNcWc:McQ+G9YJ8DmZuB23xORGCM+p
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\67d7d275e4fbb12b38fff91a3f4dda02.exe"C:\Users\Admin\AppData\Local\Temp\67d7d275e4fbb12b38fff91a3f4dda02.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\67d7d275e4fbb12b38fff91a3f4dda02.exeC:\Users\Admin\AppData\Local\Temp\67d7d275e4fbb12b38fff91a3f4dda02.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.3MB
MD5433784e48494b4579ee90fc1244fcdb1
SHA151780b557d3419fec0f1f20459a55f9942fd1b2a
SHA25682a756919de395256f4fc1fc59319137910a1957e1b179b6036ddd73f0093b32
SHA51288584e7f00f796d21788e2dee5ead41b2d17960bee5a744d634c7dac3f66f5087478c2b31e89cc2973e784ac03316a8a8a11daf2316a21425dd415a41e5eb05f
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
4.9MB
-
Filesize
2.2MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
2.1MB
-
Filesize
4.9MB