Overview

overview

10

Static

static

7

a1882445b6...c0.exe

windows7-x64

10

a1882445b6...c0.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240221-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24-02-2024 09:34

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    a1882445b6e89bf1112354e22f3062c0.exe

  • Size

    2.7MB

  • MD5

    a1882445b6e89bf1112354e22f3062c0

  • SHA1

    1c6cf8a64b32e255ba0616eb61967be0bf55f88f

  • SHA256

    b7118f6cd74d92c5fd06cb11931c161d031e6bd0cfe121b91e831bf1d5ca64c7

  • SHA512

    0562e8d8982bab35f3a5a46e509863622edd4d6dc11715e6c67b29f4bcc28f5ece7a88fde57ba4e851260634060369a43834ef6af3af2b3e8f6fa2139d93e9a0

  • SSDEEP

    49152:C99FYePL9j9qwVoTD0Cn8AzTIPqkqIreD0nn7CZQdI5+SRVUMU3OJR/:C1j/ikC8AH1sewn2+SjLaOJR

Score
7/10
upx

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a1882445b6e89bf1112354e22f3062c0.exe
    "C:\Users\Admin\AppData\Local\Temp\a1882445b6e89bf1112354e22f3062c0.exe"
    1⤵
    • Suspicious behavior: RenamesItself
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:908
    • C:\Users\Admin\AppData\Local\Temp\a1882445b6e89bf1112354e22f3062c0.exe
      C:\Users\Admin\AppData\Local\Temp\a1882445b6e89bf1112354e22f3062c0.exe
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Suspicious use of UnmapMainImage
      PID:2956

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\a1882445b6e89bf1112354e22f3062c0.exe
    Filesize

    2.7MB

    MD5

    844b44326203f024c086440a05cc8313

    SHA1

    d353703b654981b1f288ca7b55db7cf6a711f380

    SHA256

    0001906107c621edd59820731f5cba00ffc8d8e37f24e30ad268de796732b91e

    SHA512

    f3c79480f7e1bca4e0db8e0756b9fa577f309e339df80e007b50ace3e626d7c49f62a97d89e432378f717f5cf9cdc0e4330011baa0a95327f9ebf296e8507513

    Download Submit
  • memory/908-0-0x0000000000400000-0x000000000086A000-memory.dmp
    Filesize

    4.4MB

    Download
  • memory/908-1-0x0000000001C50000-0x0000000001D62000-memory.dmp
    Filesize

    1.1MB

    Download
  • memory/908-2-0x0000000000400000-0x00000000005F2000-memory.dmp
    Filesize

    1.9MB

    Download
  • memory/908-13-0x0000000000400000-0x00000000005F2000-memory.dmp
    Filesize

    1.9MB

    Download
  • memory/2956-14-0x0000000000400000-0x000000000086A000-memory.dmp
    Filesize

    4.4MB

    Download
  • memory/2956-15-0x0000000000400000-0x00000000005F2000-memory.dmp
    Filesize

    1.9MB

    Download
  • memory/2956-17-0x0000000001870000-0x0000000001982000-memory.dmp
    Filesize

    1.1MB

    Download
  • memory/2956-23-0x0000000000400000-0x000000000086A000-memory.dmp
    Filesize

    4.4MB

    Download