Analysis
-
max time kernel
92s -
max time network
121s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
-
submitted
25/01/2024, 23:09
General
-
Target
75c12614ff1ae373c3af34369c105ef5.exe
-
Size
1.3MB
-
MD5
75c12614ff1ae373c3af34369c105ef5
-
SHA1
7cbb250da20addfa68223eb5a816cb9abf80729a
-
SHA256
201b840e6fe91725b58d6aee69f18595605113f87923f46c8c841be1a89407cc
-
SHA512
830e3611ea72d71773e57c665a9072219efde8122efb0e56235eef5d4d44229e427c5f481966984823c61de38984091ae0d6ef61034e665341120c89f15dbdc7
-
SSDEEP
24576:wwPDtpl2qLWWMpfoXaVCPuuFD+xrLfuZNBMk/IzwJQFIG33fgazUkYPpyn2csq+p:ww7tplv+/iTV+xrLfuZ4mIzwJQFI+345
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\75c12614ff1ae373c3af34369c105ef5.exe"C:\Users\Admin\AppData\Local\Temp\75c12614ff1ae373c3af34369c105ef5.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\75c12614ff1ae373c3af34369c105ef5.exeC:\Users\Admin\AppData\Local\Temp\75c12614ff1ae373c3af34369c105ef5.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
113KB
MD5ddcc404bd27512e13491eff23b469bc7
SHA168059505bb80ae1bfaab9c644eb0e67041ca8678
SHA256ec7549cf9b1e2ced37f0b80fd4515707c35bbc7d3542eeab68a3f6d04dd71594
SHA5122c4002c6caf730eb77d76aa2e1f1c45836cf970de3fd5c5fe311fb93da8d234ad36cff2afa2ee60d736568cbff5b9b565159eb117fa3ba904aaa58c7d16c90c0
-
Filesize
4.9MB
-
Filesize
2.2MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
2.1MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
2.2MB
-
Filesize
1.2MB
-
Filesize
2.2MB