Analysis
-
max time kernel
93s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
19-01-2024 20:04
General
-
Target
6884f9cd0f6efc4918ea174d54862a88.exe
-
Size
1.5MB
-
MD5
6884f9cd0f6efc4918ea174d54862a88
-
SHA1
96a379541d3b8b683719049bc63337b52ff1c437
-
SHA256
23facc0455064d414015460420ff4ffbb966a86b698e258538a3b5760b5e66e4
-
SHA512
9857a79e6817771b7554e02cfe0bf2320b0d0e11e2c9278e3c443bee354e8d95b5466c906fad54296e8c0efced2418ea68a35b38ac347257687aedd94cca6a1f
-
SSDEEP
24576:7O/0Mls2WnDqTEBXegfIGZsPSeBwTTK3+xijyhFCDUIQuCZ3qW:7ulrudXfPsxwHK3awwkYXHZ3q
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\6884f9cd0f6efc4918ea174d54862a88.exe"C:\Users\Admin\AppData\Local\Temp\6884f9cd0f6efc4918ea174d54862a88.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\6884f9cd0f6efc4918ea174d54862a88.exeC:\Users\Admin\AppData\Local\Temp\6884f9cd0f6efc4918ea174d54862a88.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.5MB
MD5eba7f0921a3f857924c3b81b6d917209
SHA10381bc63e0da382967d3234c34c520768fcd0a78
SHA2565d8700e971563f5bdd68e059a39341652c32173860d5a5ef12798db1153ad1c3
SHA512bdc53cdf8584e903567db4218074c6283a2f846c70d33959fa99e49571185c97802609733c7906c16163a160397c26199cce173b0ec03b59371144dcbbf542e6
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
2.1MB
-
Filesize
2.2MB
-
Filesize
4.9MB