Analysis
-
max time kernel
142s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
12-02-2024 13:31
General
-
Target
97451e9be1e26f50f4d2dad4830da8ed.exe
-
Size
2.9MB
-
MD5
97451e9be1e26f50f4d2dad4830da8ed
-
SHA1
6433f90fe385ac650b4ae9763bc9f4c5b127feb4
-
SHA256
2c419eb07cc3980f7431c110827f0cf7e62c09c456810242583b302d748a8a1a
-
SHA512
c727edd7cd8e138ea05b4c77b694da20546cacfacebcfc3f8dee5b7fb667acca80694db13961b2b322602bffac544cb7857801f3e066dd19fb0d47211026c39a
-
SSDEEP
49152:WY04BSNYwp8SGUbYDXN5HZy63IN74NH5HUyNRcUsCVOzetdZJ:nM24GmW/3I4HBUCczzM3
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\97451e9be1e26f50f4d2dad4830da8ed.exe"C:\Users\Admin\AppData\Local\Temp\97451e9be1e26f50f4d2dad4830da8ed.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\97451e9be1e26f50f4d2dad4830da8ed.exeC:\Users\Admin\AppData\Local\Temp\97451e9be1e26f50f4d2dad4830da8ed.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.9MB
MD5e23ee95c73f600afc0f7c9e8379e1563
SHA19c43bd7b8db5ebc83a25dcc5d3018f2dcd93c819
SHA25626299849f2fe8ea0edf5f4fa379d181ba6a3d742695f820f43a1adee9eaaba9e
SHA5124f764a34d781af9888a6da5769a87745193dd1fdcd6cac5f977e7413d22bbd7654a1cd0a328171fc6fc21a77274b9e7444ef8d51df8a61627f2ef87322b61b12
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
4.9MB
-
Filesize
2.2MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
2.1MB
-
Filesize
4.9MB