Analysis
-
max time kernel
135s -
max time network
163s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
25/01/2024, 20:28
General
-
Target
75715fc1007b861814022b6da3a9c7c1.exe
-
Size
1.5MB
-
MD5
75715fc1007b861814022b6da3a9c7c1
-
SHA1
f468d0ec2843305460ceb90e0612fbc539354465
-
SHA256
5e6044fca5984612644d213abd98906fba97bcf1b90c9d1525ecba04494f0951
-
SHA512
4ef9a3d346b14e94af235d192627aef6e0de465f826d36e5938f997522df4ae4f765e28341354bcc6d0f37f4dfbad168b45031cc09adf684974e8d9703fde6a2
-
SSDEEP
24576:DT7gOztknm/1oe4QyYOZDfqDuFR/bMUDqiNaVaPgwxaLS4S+uPJwsMsW:DTUOZLa6OsoRDMPikAjx+S4SZhhMs
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\75715fc1007b861814022b6da3a9c7c1.exe"C:\Users\Admin\AppData\Local\Temp\75715fc1007b861814022b6da3a9c7c1.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\75715fc1007b861814022b6da3a9c7c1.exeC:\Users\Admin\AppData\Local\Temp\75715fc1007b861814022b6da3a9c7c1.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.4MB
MD56405429d8ac54fd6bb31d8246b114fb4
SHA104abe9b1a03a237d0376c6d8ff896054779ec2bb
SHA256f71ab016968f304e4eafe3f13cde6dc391d00fe3831994bfde911a9761ab537c
SHA5125f4b64d1a1a092e3d53a83aa6617b6f375716396b73f3d066b1b425a5aad3bcf969def6861c2aae60b1603f29d49e815f239732733e951da6f033c060b34fccf
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
1.2MB
-
Filesize
4.9MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.1MB
-
Filesize
4.9MB