Analysis
-
max time kernel
147s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
13/02/2024, 10:37
General
-
Target
9934199425ee916a450ee65e1ed16a17.exe
-
Size
2.7MB
-
MD5
9934199425ee916a450ee65e1ed16a17
-
SHA1
8b5fc0fd75ac82a3f6f62929c2064bd77563b3e4
-
SHA256
111f9dd3ea25e67300f2eb3786f931e5dbf2ba0d5fce84dda995dd5501d95924
-
SHA512
d45b7dcd8f25ff782864290f236d6aaddfa40b835548d9f71173f12846110439bfa525c83e57d88bc10775f0033ab960d776932eebf77825f23411474137528e
-
SSDEEP
49152:uawUAHuq8/kHOh8BytBic7maX/IDM66EiR9X+tIqZ3mRmijLuapH4V+fS2zJHRmD:xtku2c/IY66LHObZ2RNG/+fS2aHj
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\9934199425ee916a450ee65e1ed16a17.exe"C:\Users\Admin\AppData\Local\Temp\9934199425ee916a450ee65e1ed16a17.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\9934199425ee916a450ee65e1ed16a17.exeC:\Users\Admin\AppData\Local\Temp\9934199425ee916a450ee65e1ed16a17.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.7MB
MD59d1c58b640dbf002dbe40adf28ceeb4a
SHA1f134a94f2cbe67e9b55c6ead7f7a43f980df4cad
SHA2569fb879616f493c979daf7ab8793c1d2b8f523e93bd3204f2ce77b3e401e52154
SHA512631bd7a5e5f1874a203465db0e3ce98c70977afb0fcd68e6c247396426d088c272c92364f980bcdee3731fdae47b220f9fd32c6d27c1d493e1ba271800f1fe0c
-
Filesize
2.1MB
-
Filesize
1.2MB
-
Filesize
4.9MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
2.1MB
-
Filesize
2.1MB