Analysis
-
max time kernel
91s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
-
submitted
12-02-2024 02:56
General
-
Target
960fa5935476e6fce5542912c57e4301.exe
-
Size
2.7MB
-
MD5
960fa5935476e6fce5542912c57e4301
-
SHA1
0b89040eb4d77d39c6554ccca7eb7d574b5aae94
-
SHA256
eccded5bae97d375cb00523238d3d688df33fe1fccdcd9e1af0973f2fdd3f6fa
-
SHA512
d240c001b9c7e533b4616f032064cffc38121dfb60bbfab49a5e3686114e39237250a7f1fd65c75a9aed1f3731a19cae0d74397a5f9225b31bd451362b32503e
-
SSDEEP
49152:OpOOJSFqB4nx9cdUBw7WEvIN3ztG/H4/jnOYplIQLnBw:tOJSFqB4x9djeINhCgnO6V
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\960fa5935476e6fce5542912c57e4301.exe"C:\Users\Admin\AppData\Local\Temp\960fa5935476e6fce5542912c57e4301.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\960fa5935476e6fce5542912c57e4301.exeC:\Users\Admin\AppData\Local\Temp\960fa5935476e6fce5542912c57e4301.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
454KB
MD504fb2af169bebeaae6af51d2adfad125
SHA175914527bb6869159bb2fdaf80325d5094121b1c
SHA256e30c22bc8ba32d9943f8339a2c0489489614f6b99a61263ca9a6bd1dac33b01f
SHA5129c3ad3d031ed7ed2f4c037f25d547035bb57a9aa229fe82fd65ec6631a10be83ef2c08e074ae3a45f60878b99f81f99229f9174aa0b16dfb87afc2b1bf31b048
-
Filesize
1.9MB
-
Filesize
1.1MB
-
Filesize
4.4MB
-
Filesize
4.4MB
-
Filesize
4.4MB
-
Filesize
1.1MB
-
Filesize
1.9MB
-
Filesize
1.9MB