Analysis
-
max time kernel
145s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
-
submitted
25-01-2024 10:45
General
-
Target
747e077b94ea8c32a6e14bfd9f8ae887.exe
-
Size
2.7MB
-
MD5
747e077b94ea8c32a6e14bfd9f8ae887
-
SHA1
3b1e1f4099a7a0e5a6bbef2a437de1c02b3a237b
-
SHA256
65bf3e9db02de820042e27e6a89acfb4259635e378ff48f5c266833c5f8c721a
-
SHA512
71c53749bc7d0f8cb85bbf9c8b6f87c108172e2366150b7dd1fbfdf50cec50bd236a37e135f6b45812be8ad62828a6715c63ed8fd91d443b0437697b4805965d
-
SSDEEP
49152:6bjKyKQgaKnkbo8nvW3nM40rWTe7gMtGfzb0VMF2Ua4d3IpLfrpiuwCXf:gjytkb/n+3buWStGfidUaiMLDpJXf
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\747e077b94ea8c32a6e14bfd9f8ae887.exe"C:\Users\Admin\AppData\Local\Temp\747e077b94ea8c32a6e14bfd9f8ae887.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\747e077b94ea8c32a6e14bfd9f8ae887.exeC:\Users\Admin\AppData\Local\Temp\747e077b94ea8c32a6e14bfd9f8ae887.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
927KB
MD5271bb0ef2458a3450825357f4885ed8a
SHA188421da35e438abf85b1241163df65b1411cbd1f
SHA256c0db781194d21c328ba59002812f4a296d286f166f2d2f9924cacf7969025eb7
SHA5125ba2861ee665cfab011309210cb655e0bdd96b34a378a9f33aef4bb5212359ce1aeb33e2ae28702f654d45aaa8a22678f8fc49429f250ae46d2f9b63ed1c1d4b
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
1.2MB
-
Filesize
4.9MB
-
Filesize
2.2MB
-
Filesize
2.1MB
-
Filesize
4.9MB