Analysis
-
max time kernel
90s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
-
submitted
28/01/2024, 16:54
General
-
Target
7d819eadd312e53d6cc36637faaba616.exe
-
Size
5.8MB
-
MD5
7d819eadd312e53d6cc36637faaba616
-
SHA1
e5a799d4735a98f786f64173b5c60ec1ca3288e8
-
SHA256
3037c0ac271c330b812bc1e3d39ab62a009f8c266bad6c550fb48db2a7b4be76
-
SHA512
7ca44818f158a0e2744b82fd05a22fea6bc98dc2d1348c184077b1867cd83128059ef8fd08ff15d8d5faa8831876021426563c29f50eb4f00c55c1c7955d9592
-
SSDEEP
98304:Ywb4dKodXvlGb+oW6+ELyNS/i0+4M7U3cmv5rAdXvlGb+oW6+ELyNS:RbSPXvQKTyyNUiDw3cmv54XvQKTyyN
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\7d819eadd312e53d6cc36637faaba616.exe"C:\Users\Admin\AppData\Local\Temp\7d819eadd312e53d6cc36637faaba616.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7d819eadd312e53d6cc36637faaba616.exeC:\Users\Admin\AppData\Local\Temp\7d819eadd312e53d6cc36637faaba616.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
285KB
MD5739e0fc3e6534b77e7bea35cbf7c593c
SHA1dafb0426e03db9c62c5b236b18749db670d88fe3
SHA2561d1769cf4cafc776d40dae91d7c56d1006de78b4d5a26beba4edd299e8ab89b8
SHA5123319da5d537953711ef3e86dcd3d943182ae7c7c393a6408491e27dc20bcfa743b73f3fcc21e6afd277b4194dbb5aae55d1b7eadcda8dad5d118c9ef0fc96ebf
-
Filesize
4.9MB
-
Filesize
2.2MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
4.9MB
-
Filesize
2.1MB
-
Filesize
2.2MB
-
Filesize
4.9MB