Analysis
-
max time kernel
145s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
-
submitted
26-01-2024 23:04
General
-
Target
78a0ab7c851c03345467603c1f344c27.exe
-
Size
1.5MB
-
MD5
78a0ab7c851c03345467603c1f344c27
-
SHA1
3a7e1626d222ea5ced8726cbbf862ed56b897ffa
-
SHA256
41267175386f849b21b4d613e0992d040051c0f64d855d8587a7ad4141e93b20
-
SHA512
e7e3d764cbe75c2a676131fe1f1e7d15a45058489b579adf391de2dac06f3b4c1b0b2ff77f447fa681135f461559cf6e249467512900ce3c35477f6d4fa493bf
-
SSDEEP
24576:7aQ6A1WXFGyAF/IRYfKo8/Ondw9NwDXl+zMYAPpruxfIg+XJtDXW:6AIMMRQ8/H4DAIZruRIg+5ZX
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\78a0ab7c851c03345467603c1f344c27.exe"C:\Users\Admin\AppData\Local\Temp\78a0ab7c851c03345467603c1f344c27.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\78a0ab7c851c03345467603c1f344c27.exeC:\Users\Admin\AppData\Local\Temp\78a0ab7c851c03345467603c1f344c27.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
672KB
MD5f4be68b7ddbddd625cc72abb7c8f8e7a
SHA14cdf9672dd4a92b59f8d0ee968bbde21228b37a7
SHA2560af0cab3a0508f2a9a214c989663468eacac50ede27aa4bf1493156448ec4ac5
SHA512b21bbb304d28477dba55005f13def2f249fa40e86ace1b5acf1341da0c42a4a078b14af50f8a27f6882b71efe9e757af59e630b2f87ec9963a10c8a6b137d1f1
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
4.9MB
-
Filesize
2.2MB
-
Filesize
2.1MB
-
Filesize
4.9MB