Analysis
-
max time kernel
146s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240221-en -
resource tags
-
submitted
24/02/2024, 05:26
General
-
Target
a10e415733bfe321276f7af34b4c3795.exe
-
Size
1.3MB
-
MD5
a10e415733bfe321276f7af34b4c3795
-
SHA1
a98c17aff3f2726a22223a3592332f9609b30a92
-
SHA256
e2af3bd1e4ac19ab45120a6f11b23622a0e0c387e91e32848530a1d7c1b5a560
-
SHA512
f6e7da2e461c9af14338c701209f4912dced7eab98dfe99558d34ed688298adbf3bcd55299c8195bcb8ab1f8d14d81bf394b22edbf49eb7807fc8ea3bb6f6a29
-
SSDEEP
24576:mcnXZVJaNYXleBB/03QBpf3cxxqH0UA3TA5s0sQhvXPf8dvG:/Bde8MCxhmxvPf
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a10e415733bfe321276f7af34b4c3795.exe"C:\Users\Admin\AppData\Local\Temp\a10e415733bfe321276f7af34b4c3795.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\a10e415733bfe321276f7af34b4c3795.exeC:\Users\Admin\AppData\Local\Temp\a10e415733bfe321276f7af34b4c3795.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.3MB
MD5863b57c22a15a5f50339829b5506a58d
SHA1b9c248341db6fc14fac3dcc7fa4028c2a6a4cf6b
SHA256b57fb6bd8941a2125c1ffcbdfea08a5b57c8a0a6dec8f7ec32c792b82cb1da41
SHA512dc06ed74ff4e467168a28b9d1919b43f8aea40d16650514aa514137292738fe4ba8e60b0ed8771e99c43108b9a49c907c3324dbaaa742af185ecf9453bc3b916
-
Filesize
4.4MB
-
Filesize
1.9MB
-
Filesize
1.1MB
-
Filesize
4.4MB
-
Filesize
4.4MB
-
Filesize
1.1MB
-
Filesize
1.9MB
-
Filesize
1.9MB