Analysis
-
max time kernel
138s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
29/01/2024, 09:30
General
-
Target
7f7d322e72163c4e620f8ce21b686f25.exe
-
Size
2.7MB
-
MD5
7f7d322e72163c4e620f8ce21b686f25
-
SHA1
bc4137ec9011b40420a2f398e227dde6987ac4e8
-
SHA256
288caa5899b80fe34d4aa97e1810d27ee517ec00969ba9d4eb2fa030994d1742
-
SHA512
6ca1eb0de90081b38ed767b173a9b7d360faef789077598c1614dbde295817ebdaace10cd5272071e6b1aecd1bb79b7763fcdc4276bc02ce17da05fe6a45c6f8
-
SSDEEP
49152:qmqOpnQ0LFFOKfjC1jNAqrKArrjdvHSVeBR9ktBc1+Q4YdxSChG38bDUggR9t:q+nJLFF/21jmBorV/HktBcwQDM2YIDUx
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\7f7d322e72163c4e620f8ce21b686f25.exe"C:\Users\Admin\AppData\Local\Temp\7f7d322e72163c4e620f8ce21b686f25.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7f7d322e72163c4e620f8ce21b686f25.exeC:\Users\Admin\AppData\Local\Temp\7f7d322e72163c4e620f8ce21b686f25.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.7MB
MD5b538b8e8f58ad6bd64ca2adeb662255c
SHA131257d36ce3a91e711e50030eceaef3587b391b3
SHA25628034a005ee9415a65bfbc59b2d054d3a745678ee5a568784a7a87a8fa963f4a
SHA512191f777e2f0dfee5a9a385bf189ddeaa5078c6dce06fd6567277a312362de2a8398654b680956fe9946ae045732459b75712e837bf23b0695ece82024e2431bc
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
4.9MB
-
Filesize
2.1MB
-
Filesize
1.2MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
4.9MB