Analysis
-
max time kernel
92s -
max time network
122s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
27-01-2024 00:05
General
-
Target
78bfb1ba98c0a3a2c764520f9179d9a5.exe
-
Size
1.5MB
-
MD5
78bfb1ba98c0a3a2c764520f9179d9a5
-
SHA1
0ad3a2ce0452a0d35e800bf51c42595cd5913af0
-
SHA256
598e5408c0c164ed0cd213226fff513fabbf2e41920df1cb5a261b0da867dd4e
-
SHA512
dd9426f66ed1ae43c7553f715d6579a4797bc6c3705d998783444001650b78a3613d2fbf33b7429145b31be0e1a9c77a548c181fcc922260bdbf6458cf29d9f0
-
SSDEEP
24576:hyZr7dhMPeuBS0ezGNFXs6kzuPq+ZPcebgBH2UBB/5Yeu+Tbx7DWW:h4HaeD0eu5quPcmg0Uv/5/u+TbVW
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\78bfb1ba98c0a3a2c764520f9179d9a5.exe"C:\Users\Admin\AppData\Local\Temp\78bfb1ba98c0a3a2c764520f9179d9a5.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\78bfb1ba98c0a3a2c764520f9179d9a5.exeC:\Users\Admin\AppData\Local\Temp\78bfb1ba98c0a3a2c764520f9179d9a5.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
160KB
MD5e37184918f32e8966325ea6a6ef8450c
SHA1a3da54b97c14ae30e79bc26a4d4094e4f1b2e78a
SHA256ccb105c8c2ee5cad7250734af0c84eb98a16e5091a136c601a9b92206cc34a69
SHA51222e30947aeef659394a50872da86f921870344da5cc92ab576c22ac0b10236d5d3b1ff99c2009aadd426e4a6688853624fb862f232b51c1adaaad2d483b58c1a
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
4.9MB
-
Filesize
2.2MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
2.1MB
-
Filesize
4.9MB