Analysis
-
max time kernel
140s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
-
submitted
26-01-2024 15:43
General
-
Target
77bfd76f445a6dce87e6843502804e33.exe
-
Size
1.3MB
-
MD5
77bfd76f445a6dce87e6843502804e33
-
SHA1
c97cc4c2338238c59ca3f003a9b073cbf9f2a1d3
-
SHA256
8cbbdfe1afad2002bf8ec3b50d271609eaf77347b8594a6204056727a76a848d
-
SHA512
e9c60259b69c325f97cc6c473469e8650bf02059b952dd6d364e14f839c38d1dff70b9d007317a11c28b2a467b473799b14ff18151c024a77e98412422a21764
-
SSDEEP
24576:9t/dAikPXfhMCvUqjeEs0oDBN2m3IMnFnTf6KwcI4iUXl5mAcGU9/9Us:9BdAikPXem00oDn2q9dI4iUjmAcZR9j
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\77bfd76f445a6dce87e6843502804e33.exe"C:\Users\Admin\AppData\Local\Temp\77bfd76f445a6dce87e6843502804e33.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\77bfd76f445a6dce87e6843502804e33.exeC:\Users\Admin\AppData\Local\Temp\77bfd76f445a6dce87e6843502804e33.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
189KB
MD52527df63da553bf7eb58c91b05ff8e82
SHA15914c1b1a7d96a4800fcdd46c6dd3e4960cca545
SHA2567eaf79350e0f2daca40ad66cf5d450da31278d48f7be70a8970a830bd6100262
SHA51263ed245ca7bc3f611cd300ad7b686ef1c4343c429292bb928dd33828f44863a85f3594cdab35a42951c53848f634ce26efa0ea197c1eedf92a4ce989249f5be4
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
2.1MB
-
Filesize
2.1MB