Analysis
-
max time kernel
145s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
-
submitted
13/02/2024, 18:14
General
-
Target
99ce3bdc622121d6659d28cc39daf5b3.exe
-
Size
1.5MB
-
MD5
99ce3bdc622121d6659d28cc39daf5b3
-
SHA1
8baf1bde8d3b2e290055d5428ebeb539e04bdafb
-
SHA256
181bed91b6b493f02e5473c37e38e48a6f0c3fbb2d9d725f21f4f5089eae92f0
-
SHA512
4d1ce27a7ad80e7bd5c1cc6b8a572087bda525e1a08b150c7cfb50a5996b371e0fb23dcbefaa4ef827914bb52bbf9044d3ede62182eec6fc491e9c5a95ffb5a1
-
SSDEEP
24576:auuRniEJhMVVhO7olEcBxNbaC99I8bKL6t+qrl4cq2jV0/tu7L30EGvXHnnXkX8y:aV1fMU75sxp19pY6tQ2Yu7L30EkHXkX
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\99ce3bdc622121d6659d28cc39daf5b3.exe"C:\Users\Admin\AppData\Local\Temp\99ce3bdc622121d6659d28cc39daf5b3.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\99ce3bdc622121d6659d28cc39daf5b3.exeC:\Users\Admin\AppData\Local\Temp\99ce3bdc622121d6659d28cc39daf5b3.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.5MB
MD55388b0fd597eaa70e4dc6a27fbdb99c2
SHA11ffdeb220ec118fe290677e597d28ea0d192f0a9
SHA2561f61a994cc5f2c0005c0e5b8712d4b9b0c7de9e82cd8aa746e9c6c170351ce76
SHA512a19301f2080e26b8ff812223ae95e4834e0dd919b62f9161455c1af6d7e1988d71fd385156f764ac90af89e8a1a816dd017dda00add2267e2336b30bec150e4e
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
4.9MB
-
Filesize
2.2MB
-
Filesize
2.1MB
-
Filesize
4.9MB