Analysis
-
max time kernel
141s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
02-02-2024 06:06
General
-
Target
88c1716fbd5de56d344547cc1a124ba9.exe
-
Size
5.3MB
-
MD5
88c1716fbd5de56d344547cc1a124ba9
-
SHA1
717a533b8b91d14ce5331a48dedb1dad597736e2
-
SHA256
7ff49b68e1ed52e0c3e88dd29ff97128d2fbbc4d0b6398e0f5b61a0362ebf179
-
SHA512
09622c18d6efd2d97162749208819626edf3f7c984a606544b997067ba4192a9875133f5223cb87a9dcf1ae6e79e282cb72a5c5b26b4492bf765f234980bd3ff
-
SSDEEP
98304:IJb+6uTMDKFkV3LH7d8JpmmV91oqzHvVGVf+jY/UvJQc4H7d8JpmmV91oqzHj:IJb+4bd8JYmhtPjs/UvJP4bd8JYmhtD
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\88c1716fbd5de56d344547cc1a124ba9.exe"C:\Users\Admin\AppData\Local\Temp\88c1716fbd5de56d344547cc1a124ba9.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\88c1716fbd5de56d344547cc1a124ba9.exeC:\Users\Admin\AppData\Local\Temp\88c1716fbd5de56d344547cc1a124ba9.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
264KB
MD541bae6d930d432736e34c67c9c408c21
SHA134e0f0141a1a29e6e887cfb949e770a07b5fc47d
SHA256c156dcc45074230a4a2e1b7a86981f670162ddad0780079892252d4ee186969d
SHA512a451404e243ad947c168a9bad4784e62f7de137dc9d4e1f5daacfefbe8eefbc194c4dfe5f8be5872e046e58466203969a98b05a7881f7fba0893a853b5f84eab
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
1.2MB
-
Filesize
4.9MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
4.9MB