Analysis
-
max time kernel
93s -
max time network
128s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
12/02/2024, 13:36
General
-
Target
97477901e07756e8b5e282b0b99880af.exe
-
Size
5.8MB
-
MD5
97477901e07756e8b5e282b0b99880af
-
SHA1
6c3364f1e536a7dcdda5de2be5ee31c7850d25c7
-
SHA256
d7597a9efbb41f6f09bc2160783e3536ab0dd0c4d531925e6d90cf4b6a3a844b
-
SHA512
09c8deddf2fc5e5451941d63798d9b380ab531e7260c6761b2a44f54caaa6e35402308f49bc183296313ee0a613675a2a1cb1a78557e78d38f8e74b83323634e
-
SSDEEP
98304:hUbgWS/YZL4F+0apNSiHau42c1joCjMPkNwk6ndSXj1IAcCbkOdrzGNoK2Hau42j:u6g0Ehauq1jI860Xjc2kOxauq1jI86
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\97477901e07756e8b5e282b0b99880af.exe"C:\Users\Admin\AppData\Local\Temp\97477901e07756e8b5e282b0b99880af.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\97477901e07756e8b5e282b0b99880af.exeC:\Users\Admin\AppData\Local\Temp\97477901e07756e8b5e282b0b99880af.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.8MB
MD538cd7f30c5df34f1b023ce25b1d850d3
SHA10b98720caa7dad9407308d728da831606334a25e
SHA2564061766f210e8bda592f5a8391bd83a15f589123f57b88810c2be5a56285abc5
SHA512b64761ef071f4c5ecf703c4bb0a5ace40b24ed97abe8da898848a4231e4ffc5afd0fb587fe4ff56f53df1c98af45f54e831cabf92f9c941f4372628f87887b6c
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
4.9MB
-
Filesize
2.2MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
2.1MB
-
Filesize
4.9MB