Analysis
-
max time kernel
90s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
-
submitted
13/02/2024, 13:59
General
-
Target
99992ca748bdcbac6eeec7a8b567e515.exe
-
Size
1.3MB
-
MD5
99992ca748bdcbac6eeec7a8b567e515
-
SHA1
3ecb3e586ec56696a9adf37de005619e9bae9c5e
-
SHA256
f97d504a0c6096cab3ddf1944c40087545a0290e0cf3205edb105383384b7f23
-
SHA512
e54ba0e6eb5cbad6040ce1bbf43c587a2882b2cbade186009f70b83bd338ad66f5e5b6b47cd6b9bd7b4a6780363cf50f5366493b00bec8860c81ddd0f3f738d3
-
SSDEEP
24576:cNvwu7O9hAD1ZrQAi+C5GNFWqmdRuNFu2/nocFy+CC0c32AAPprWc:cNvwu7O9hAiVGNEqmevVAyyxc32TRp
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\99992ca748bdcbac6eeec7a8b567e515.exe"C:\Users\Admin\AppData\Local\Temp\99992ca748bdcbac6eeec7a8b567e515.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\99992ca748bdcbac6eeec7a8b567e515.exeC:\Users\Admin\AppData\Local\Temp\99992ca748bdcbac6eeec7a8b567e515.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.3MB
MD530420f9409cda67933f7367f6ce1c22a
SHA138cfa336383c74503e9b905933f64b2e44fc7317
SHA2564bc6904a09f1cb21f10f3a138582636189c57755bf7416d81664fcc9bf3d198a
SHA51296deacbd2aaf783b5a9996ea464ef02189fc1fb8273901d7b38745d9d3be538c80c08bb63ab71f793933601b3a4f6a3eec46ebffbf2e709e504374b19bb9beca
-
Filesize
1.2MB
-
Filesize
4.9MB
-
Filesize
2.2MB
-
Filesize
2.1MB
-
Filesize
2.2MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
2.2MB
-
Filesize
1.2MB
-
Filesize
2.2MB