Analysis
-
max time kernel
91s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
-
submitted
24-01-2024 23:22
General
-
Target
7320a9b5094b71e8024eabde572315f0.exe
-
Size
2.7MB
-
MD5
7320a9b5094b71e8024eabde572315f0
-
SHA1
f629ce7c593cb781228c001bac1f975ec155f3d7
-
SHA256
b1185174f488fee7e7507f71354454efe40d3db14963778b94bbd3dea7ea9f4e
-
SHA512
e7bdac0bd331dd2bd0d8a54ee569b50e53d643542edc4bc3730ca1cf5f8381e6d6f4f4fbcdacf4c356fbb5e087a048ae2b2b6a9b296b83b75b36ee71f4d0c8c8
-
SSDEEP
49152:QGv04PEhqgmCbcylsUeUua0md21TL8XcsvLo8QCv:QGc4PEhEcHpua0hIMsvLo8QC
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\7320a9b5094b71e8024eabde572315f0.exe"C:\Users\Admin\AppData\Local\Temp\7320a9b5094b71e8024eabde572315f0.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7320a9b5094b71e8024eabde572315f0.exeC:\Users\Admin\AppData\Local\Temp\7320a9b5094b71e8024eabde572315f0.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
283KB
MD540385d31aac00c08c27d7b1123f2bc8a
SHA13ed36aa1a09f16a5105c9503f19e374382c62d9f
SHA2569fc39962e14f0d91d281559e655d87a5b79dd73d5c8df902d8912e3a7df07471
SHA512584cca2d7ceba3d1b4a0bf8cb426e2a8cdbd60e0b4ba85ea086c9035eb61cc329ab6e60ac8e43344e421143d8cb90ed716186995ce30f488d1e8185b75ca3aa6
-
Filesize
4.4MB
-
Filesize
1.1MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
4.4MB
-
Filesize
1.1MB
-
Filesize
4.4MB