Analysis
-
max time kernel
143s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240221-en -
resource tags
-
submitted
24/02/2024, 10:02
General
-
Target
a19711812f010c404b4f0d4a6d62af1c.exe
-
Size
1.5MB
-
MD5
a19711812f010c404b4f0d4a6d62af1c
-
SHA1
139f053de6cff8dd7e1d2c1f3bdf037bd8e87e9f
-
SHA256
71498a2c6d1693adfae27cd347d2ebf3aefe63763c3803d5c7eee15dd3ccc9f1
-
SHA512
6baa0aefc751a9cce7b637b73e82a641431d40b788d13d30b5a45360bb379b897e55341766f842346361b1011fb0fd324c3f8b0fe780755a22fe99c30634006d
-
SSDEEP
24576:UOZ/deb3Ws1rJ1kTEOm20mmaXx1FHkzl/YQk5Jg+mPeNLxEiVhEXr1RlSujMW:ngrdJOT7Ql/ReN1K/AN
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a19711812f010c404b4f0d4a6d62af1c.exe"C:\Users\Admin\AppData\Local\Temp\a19711812f010c404b4f0d4a6d62af1c.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\a19711812f010c404b4f0d4a6d62af1c.exeC:\Users\Admin\AppData\Local\Temp\a19711812f010c404b4f0d4a6d62af1c.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
896KB
MD57527d204c2b29bc3484bbb0652b07393
SHA10ab82b915087a9c93b72dd367b405592c4ff151e
SHA25617c7a9472b7d9a73b7ee68586af16f5effbe62233d5e0d629b8f14efdc309c78
SHA512a952e1d8f7c787248c1898d1c082ba0388a6357782db45dfec0e7071a0b9c44209fdbe9269312c7158ae3665213e81404ec54b6e11f5c7a60593692d19dfd176
-
Filesize
4.9MB
-
Filesize
2.2MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
2.1MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB