Analysis
-
max time kernel
142s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
26-01-2024 04:29
General
-
Target
766293eec2c624416a326e3f10434eca.exe
-
Size
1.3MB
-
MD5
766293eec2c624416a326e3f10434eca
-
SHA1
dd79dc64fdc9828bf3178cf3684cfa6f155dce90
-
SHA256
29b79e9553131e4866906744ed07a5896b622095376d0fe553934fa699b8f3a1
-
SHA512
146267f8e6f096f4a6b9ec7d0e893cb48fd79e64726a8ee2f28b9d7718cbd5a697efdf09fcf5e48efe83d814118d07762fd05695bf79e09cdad159e4c797f93a
-
SSDEEP
24576:KX4nwvufwfxGkfIV3uYkH2tFWe9KNUQ2CIX3mBt8vUAdDr2KhriOWc:KX4nwvuIUMXegNOmoUAxr2KliOp
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\766293eec2c624416a326e3f10434eca.exe"C:\Users\Admin\AppData\Local\Temp\766293eec2c624416a326e3f10434eca.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\766293eec2c624416a326e3f10434eca.exeC:\Users\Admin\AppData\Local\Temp\766293eec2c624416a326e3f10434eca.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
489KB
MD5eac4b38b025edff0d0dabfe1e21bb688
SHA19bdadced9ba0df819fd5caf3b7a22b976e6ad15d
SHA25675319db31526fe2fb6dc217835452a09b16cf42aea97da25e59baa224247f6bd
SHA512549275ca7599b401be16ef937c70cb7322a8f5cf01febb624d6892e9998d202f69db820b76e75dfc4f310ee7214022907aed7e6ba75c8fa83314ee5a395af0b9
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.1MB
-
Filesize
4.9MB