Analysis
-
max time kernel
145s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
-
submitted
27/01/2024, 14:20
General
-
Target
7a78f5d9d6b120146b6dd9d542a4f26d.exe
-
Size
1.5MB
-
MD5
7a78f5d9d6b120146b6dd9d542a4f26d
-
SHA1
fef83865398c63c755fbbc2ff4e9b39b2861e696
-
SHA256
0d0cbe7d1a29d5a3e2897e2988c2834f32dc92fd5565d4f694c3d31a48c6da2e
-
SHA512
9b630400c4d2a81ad94d46478105511aaa4026ece73c453932925f1fb6dd13010defd9b75ad3b8116d2d5185535d643d1af0cbcffb173a8ce2ef69747ee90a88
-
SSDEEP
24576:wjo4uvgEvngmJzlsr4R64flxs7UKbJ3Dn8ftKdGlqhGb3IwAKh+W:wqv9ls0Rbf0NpgUngb3IwAKk
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\7a78f5d9d6b120146b6dd9d542a4f26d.exe"C:\Users\Admin\AppData\Local\Temp\7a78f5d9d6b120146b6dd9d542a4f26d.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7a78f5d9d6b120146b6dd9d542a4f26d.exeC:\Users\Admin\AppData\Local\Temp\7a78f5d9d6b120146b6dd9d542a4f26d.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
136KB
MD51478147063f12a2ae0d9fd6f85a43c70
SHA107ae8365c472f6190827da7ab7a2c6e2d4e20f73
SHA2561ce049282e0896c3ae412e953f0ad2b85a25344b2dc6ef19359c5065b2ff5bc1
SHA512f306ffb94633add29240aa78feece5565fd0f79a4626d524b665481befd09a5035e9cb50aa4b6f3ef43b8c964e561153970d41c1883937fdd5a44330fda2e723
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
1.2MB
-
Filesize
4.9MB
-
Filesize
2.1MB
-
Filesize
2.2MB
-
Filesize
4.9MB