Analysis
-
max time kernel
144s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
13/02/2024, 16:51
General
-
Target
99a6b4cef208ce26e36cc4a70f849b89.exe
-
Size
1.3MB
-
MD5
99a6b4cef208ce26e36cc4a70f849b89
-
SHA1
9b2ba6a459a424652a26162f7a4a4f3d3abc71b6
-
SHA256
5ded74bb72c85d41a69ad7e64b9caf777672938abcb7ab4c2d1df22a4e2ade30
-
SHA512
0c85c6919dfa50ed36dec6dfb4617c5ab74c6a91d5560da342f72140a9fdacb8988eb99ebf9e77377d3e41bf5d2f0953749ad2afdceba0382770d532934a3774
-
SSDEEP
24576:nEgH2qCjh58osnO/ZcFERe7ol56IteoV0dCwKJ8QFU9/9Us:n7z4h58znORWEw0f6IZdwcWR9j
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\99a6b4cef208ce26e36cc4a70f849b89.exe"C:\Users\Admin\AppData\Local\Temp\99a6b4cef208ce26e36cc4a70f849b89.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\99a6b4cef208ce26e36cc4a70f849b89.exeC:\Users\Admin\AppData\Local\Temp\99a6b4cef208ce26e36cc4a70f849b89.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
832KB
MD5d4e1ec98d881e527cb0d86e5ab957145
SHA1d2b5a7218a404cfb630708d0f3f2b75356b0bed1
SHA256d660411c392b3f9d3f4898d956d6df4fac682c493af9110605765d493d0dcf0d
SHA512c6160d125563d601b2133fcb6bb4859423f19b305127668c78d58870a446f29cbe34a7c68013e2828b3cc7460d611d7d127af81c78c073dda053b92dd9e1406c
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
4.9MB