Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
12/02/2024, 10:17
General
-
Target
96ea66b60442380f50ca9dc253fe5bba.exe
-
Size
2.9MB
-
MD5
96ea66b60442380f50ca9dc253fe5bba
-
SHA1
a1109c1969fd8347245b2d9aa781d1696f946b11
-
SHA256
25605c3866a5b4d406c904645cae8245a0892632de78b27e0d862f4b23e45d37
-
SHA512
5925022ab9d19a2ce32fd506887965a238d61428bd8f8b3b18c862cbf81ed49d7a03ff28663b6c4e7880497271c2fd1f6cbe73ca4731caff18ffd282f3e2c70d
-
SSDEEP
49152:ruRFYFnlMp/CLbSE9CF1OsdN74NH5HUyNRcUsCVOzetdZJ:yRFYFlMgLbSE9y7d4HBUCczzM3
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\96ea66b60442380f50ca9dc253fe5bba.exe"C:\Users\Admin\AppData\Local\Temp\96ea66b60442380f50ca9dc253fe5bba.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\96ea66b60442380f50ca9dc253fe5bba.exeC:\Users\Admin\AppData\Local\Temp\96ea66b60442380f50ca9dc253fe5bba.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.9MB
MD548be4da11215a4b8e583720015812d7d
SHA1a99a8d4a80382696f0e86e48f4469f912a688764
SHA256b0f18015baffb50b93f511b8d4b6b48b7a9358bc52bcf11738f57bea96275dad
SHA51245294139bbdb1fe584861a48e14baad8a87423e955cf6fe7835013afc97916546de9c0b68c5cb65e4053ceaac512c35e17307ae1d8eea6f4037f307d3d7cb1cb
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
4.9MB
-
Filesize
2.2MB
-
Filesize
2.1MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
2.2MB
-
Filesize
1.2MB
-
Filesize
2.2MB