Analysis
-
max time kernel
140s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
13-02-2024 00:09
General
-
Target
97f917ced4ea24170af46ba17d13b687.exe
-
Size
2.7MB
-
MD5
97f917ced4ea24170af46ba17d13b687
-
SHA1
0a40ddae156fef73f0e41be5fc763ad38cdb9f8a
-
SHA256
7d9d78e2ac902638d3cd73b3fd042ce50c19f061716266f4ce829f8936cf33d8
-
SHA512
b3c707ace5b2bf41ee71858e454e844f6771326e0b778869f658e906c5d1e125cfc82f9fb92cd488a7780d15e7edeba69be96a4f4f5f7eaf28f1b285980cc619
-
SSDEEP
49152:MLBIMuNyH8jO94bsYh6xxSXP1MqmUBJCyinKdhuv5IpDKlKoUIrP34p:2ItNyHKO9wsYMAqUbCyiKiBIpD1onT3q
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\97f917ced4ea24170af46ba17d13b687.exe"C:\Users\Admin\AppData\Local\Temp\97f917ced4ea24170af46ba17d13b687.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\97f917ced4ea24170af46ba17d13b687.exeC:\Users\Admin\AppData\Local\Temp\97f917ced4ea24170af46ba17d13b687.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
960KB
MD5919899bd95fe6b489f8c66f276eb4554
SHA1609f9387631bc0bc459586384bc759daa797c903
SHA256e2bbd4ce2ed213fb1f99ed653993b5b7f10123ad12994b02fe2471c6211427d7
SHA512f7f9cb19f1b63bc090203e2992f1500cfd17a5cda77ae0068d778cb31fc321e5285f731936befc33ad194a870de5d781daa946bf1f2441653c9fb60809e73001
-
Filesize
4.9MB
-
Filesize
2.2MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
2.1MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB