Analysis
-
max time kernel
143s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
29/01/2024, 11:04
General
-
Target
7faea91cc3255be534c9c6250adc81c8.exe
-
Size
2.7MB
-
MD5
7faea91cc3255be534c9c6250adc81c8
-
SHA1
ac81a2fecfcedb767ac010a7383ae14395544f2f
-
SHA256
be866f4d72991d2e3e6a7e1ddcd5171e4d82cdb6f4de54d651961acc68e82e54
-
SHA512
7d62194255ad90565f2ce98cc7644de73948c648e63a1c19233b01f9b9a12b187effed9adbae95ff2fa862b93cd219637abfcb00eeef2812be5558a8256e9c1c
-
SSDEEP
49152:iGIHfGGVSoP44ce3BfAb55Gmr+OZ8dWr02R9mttZ3lMOnmMfmo6G1oqoti8R9j:i3fbVJ8SSJt6dWr02HmttZRnmGmo6G1A
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\7faea91cc3255be534c9c6250adc81c8.exe"C:\Users\Admin\AppData\Local\Temp\7faea91cc3255be534c9c6250adc81c8.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7faea91cc3255be534c9c6250adc81c8.exeC:\Users\Admin\AppData\Local\Temp\7faea91cc3255be534c9c6250adc81c8.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.3MB
MD51026f51d0344d93e62be6f14809c0665
SHA1137c1093d677ec525fd972117296e1afc16b526d
SHA256ad897d5158e6e6ea6ce5c80c1910715f65701eea0421475c7e535216ddf5a561
SHA51250faa923ba36dd08ae015638f2e823d98889532cea2fa2d57c7c1c66758d435dd73d3860bfa8300b639c853a4038dfb5fa4ec75b89655d97c2c2a820d68f1ac6
-
Filesize
4.9MB
-
Filesize
2.1MB
-
Filesize
1.2MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
2.1MB
-
Filesize
2.1MB