Analysis
-
max time kernel
91s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
12/02/2024, 01:55
General
-
Target
95efc4db480cc202b0237a816f5be344.exe
-
Size
2.7MB
-
MD5
95efc4db480cc202b0237a816f5be344
-
SHA1
17d77f2c21ceeec7729a1cd13d732de55203f6ea
-
SHA256
e5a56d98e4f226903d24645a756bc670074e6fdd5caba1f87cc7d40021b43894
-
SHA512
72441aaac3a89c4d8e3cb7349bc9a069b41c68233605b3df28fdeb9fc4d7f743adb830a958f9201d33af1743486955f94df490a9e29847de602ce79409bd8659
-
SSDEEP
49152:HUqdP6Qp00QSUZR8dt89yTI2+urfT1TL8XcsvLo8QCv:jdP6A0MemJJftIMsvLo8QC
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\95efc4db480cc202b0237a816f5be344.exe"C:\Users\Admin\AppData\Local\Temp\95efc4db480cc202b0237a816f5be344.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\95efc4db480cc202b0237a816f5be344.exeC:\Users\Admin\AppData\Local\Temp\95efc4db480cc202b0237a816f5be344.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.7MB
MD57c8ca46f7bc4690e7c5b605b49345557
SHA1be822bd24a70811c2a5c1758dba269edc209642f
SHA2566fee1e46be7299f3e4e5714a23b8a597c286d7d692557bb3a0fcb266d059eae8
SHA5122ab5c97de61ac8553924337f99ab07d1d3d04b27f5c29327540550bbaa70163024e7069f5417e1a351e08c05d67cb9387bc6a225fba5489687c142c4ef941173
-
Filesize
1.1MB
-
Filesize
1.9MB
-
Filesize
4.4MB
-
Filesize
4.4MB
-
Filesize
4.4MB
-
Filesize
1.1MB
-
Filesize
1.9MB
-
Filesize
1.9MB