Analysis
-
max time kernel
91s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
14/02/2024, 06:02
General
-
Target
9af209808b954bc2f6b28eaaa321617f.exe
-
Size
59KB
-
MD5
9af209808b954bc2f6b28eaaa321617f
-
SHA1
99ac3095bf0c76fe733397d1f5c1d3dfad59f799
-
SHA256
6fe542a4ff3aabbc2d3cb536f1a0c84fe9fc8f04630c893edcf91bbc08e60e59
-
SHA512
41084b12fd036a155688517f87a44d0e0bd1dcb35f4b8d2eea3cf0b634ac58fe26efa44e1b920c211c5e25f26f5edbab97fd77dbe0c7bd07a2e933b65e4a46e3
-
SSDEEP
1536:3Ff3jL7tLR5EP2pT2rU1XhQdvvjJAkVyJrscCvOoYqD8:3JTvtLDI2R6UxhQdT2bSOoYqD8
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\9af209808b954bc2f6b28eaaa321617f.exe"C:\Users\Admin\AppData\Local\Temp\9af209808b954bc2f6b28eaaa321617f.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\9af209808b954bc2f6b28eaaa321617f.exeC:\Users\Admin\AppData\Local\Temp\9af209808b954bc2f6b28eaaa321617f.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
59KB
MD5147e5d15232e6b5a386b4ff0255a2ccb
SHA1fc67c3599c5f965f2d00389c2e95dd1c70c4a405
SHA25635176790ff7843abcdbd172dbbf549debe11b353142db5caf38add3dbac72bab
SHA5127247d7fcd015c567c4e4c77414c580d4f8c65dddadd66b103d350325de7b3313233287ad6441a08cf19e621dc0b11e68a5d3dbada3ca0078c6c491179a6d25a2
-
Filesize
116KB
-
Filesize
60KB
-
Filesize
244KB
-
Filesize
56KB
-
Filesize
116KB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
60KB
-
Filesize
116KB
-
Filesize
116KB