Analysis
-
max time kernel
142s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
26/01/2024, 04:02
General
-
Target
7654c909bcf32676e7c8dbb88dd0082b.exe
-
Size
1.3MB
-
MD5
7654c909bcf32676e7c8dbb88dd0082b
-
SHA1
e8b4cbb7c6e34209431064b0a2013e0e4249eeb1
-
SHA256
8afed99cc5d88ec76db6a9b5d84e1c3491a9154bea07034dd58a05dde0c58ac2
-
SHA512
20256b9bee2abdf4f5c3c7d57f2ed798a804ed347c6b5b72ea18a2d5dbcb46354e919aeca8ab871c548fa15e70bf2c073ea30986f0ddf0ec240db3b25e6f82f2
-
SSDEEP
24576:XpB/YfZ1szVK+jJl1aOhSFAZgq6ngisbrPseTD+6HHqTD1SyECq4TdHZWKJXJ2UD:5BYZ1szZrhwA2q6gisPB7uD1nLZWKJnD
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\7654c909bcf32676e7c8dbb88dd0082b.exe"C:\Users\Admin\AppData\Local\Temp\7654c909bcf32676e7c8dbb88dd0082b.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7654c909bcf32676e7c8dbb88dd0082b.exeC:\Users\Admin\AppData\Local\Temp\7654c909bcf32676e7c8dbb88dd0082b.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
312KB
MD5952341039da47a954d30043cc50f7012
SHA1d8229d32f766afb645fdc96cffa6140ebeeb9faa
SHA2566e0c63b12fd30f2ddfe195b2b6e14f0a1928be6234a54a63afdd4dcbd1ffff8e
SHA5120576b08faac3f4517cb81f52b7175a8fbccd84f8a3cef2ab9d0b67ded22f71381f48453f81beddf07403464ef5ee3a50cb059ee5df3a54a87aeba9dc653d9b3e
-
Filesize
1.2MB
-
Filesize
4.9MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
2.1MB
-
Filesize
2.1MB