Analysis
-
max time kernel
137s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
24-01-2024 10:29
General
-
Target
71fe4a92055488c60ac869b6665a12f6.exe
-
Size
1.3MB
-
MD5
71fe4a92055488c60ac869b6665a12f6
-
SHA1
2a1086600a0e25ce251abc382e17c2116d1d614c
-
SHA256
af328083dc07cd4e3e34e3836b47ba46e375512d1c1b958674085705bc04f8ad
-
SHA512
4e08e475f5f89797f586d9e3c12824925bc2f04db4ec96ce279a71ceb90851417814369398665a78d216e31dedee83a4ea0769f29ebaa3303a2c6ad2765ffd19
-
SSDEEP
24576:ka5vMFQHf2MHGpGwA3L4i+CpEoXc4HGO2Vbu6CmKIbVLhmDLjFlU9/9Us:HMWHnGa3LjrF2VbfCmKIbVLhSLj8R9j
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\71fe4a92055488c60ac869b6665a12f6.exe"C:\Users\Admin\AppData\Local\Temp\71fe4a92055488c60ac869b6665a12f6.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\71fe4a92055488c60ac869b6665a12f6.exeC:\Users\Admin\AppData\Local\Temp\71fe4a92055488c60ac869b6665a12f6.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.3MB
MD5c31d6968cef5d4ba7c367d27aff2cf39
SHA134a17a83dffb7c2426e6ab30b1afc36f609bc6f7
SHA256ce76ed57adb071b0ecb88fcf3ca7dd785f7973fd9b81c482e7bec80eda626c86
SHA512b199640ab2b37be426e70451f5ff9bfab72f88cfb9b0536b09df6581e82271d2a83e4892d45fa310fd048d8594efa23db7cf8d18473b8d83b1b0fb762c776ed6
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
2.1MB
-
Filesize
2.1MB