Analysis
-
max time kernel
90s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
-
submitted
29-01-2024 07:22
General
-
Target
7f3c6aa6a6063939810743e79b6dc0b0.exe
-
Size
5.8MB
-
MD5
7f3c6aa6a6063939810743e79b6dc0b0
-
SHA1
2489983a4e07390c31613cc8e02c28d4bb019960
-
SHA256
6fc11b91ce2da60380234461f3a0a627b43c624b59de0b152524a5a254129c6f
-
SHA512
f68eaa27877f0b59566b0c4b2a3eb770a2fe12a77ac19a0d1182a6a593531e055aeda0487cc51608f08cefbc55e4a63d787a3454ce8868cddafac42f26801b17
-
SSDEEP
98304:tpGUeX4sLfDBJAsrW4gplurxkK+0Nh7AC96JP2mA6AsrW4gplurxkK+0Nh7A:blU9DDBWsS44Aj9GAhsS44A
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\7f3c6aa6a6063939810743e79b6dc0b0.exe"C:\Users\Admin\AppData\Local\Temp\7f3c6aa6a6063939810743e79b6dc0b0.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7f3c6aa6a6063939810743e79b6dc0b0.exeC:\Users\Admin\AppData\Local\Temp\7f3c6aa6a6063939810743e79b6dc0b0.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
545KB
MD5e6af16ded06735e5e2cd5fd1c16f81ae
SHA156c8e63d7eb3ad06630ec2ac8c871801fa87d32a
SHA256814b605c8d463b65a2a744712fff607302164b4fec42ab024b24d4f68ff6f7f6
SHA512f475420aeb9566bfe6465d0e7178b26bd8b5747278362686a924de207dfca0a17dfbba80930549a2273f20d6be304e3fe348b1de43a24055882696f699ba2349
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
1.2MB
-
Filesize
4.9MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.1MB
-
Filesize
4.9MB