Analysis
-
max time kernel
147s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
27-02-2024 23:07
General
-
Target
aa6344a754a7b33cb7c6321f17399866.exe
-
Size
1.5MB
-
MD5
aa6344a754a7b33cb7c6321f17399866
-
SHA1
e18beb647ec5980cf135fa1347521be120b8d5bc
-
SHA256
42a13f016cbde5ddb90f7238e67754ca907f26b6879a445c6ea857076d1568a3
-
SHA512
2392894c09d2c1f92d2f784d5b33e47c01bccb4c3a6c42fa35ac511ced2044b2ea0e6ba9ec7a6e368a5b1b30b8e2477debf066f31e3b56826391fea4b5339eb2
-
SSDEEP
24576:LbE44peVPN7TXxtXhGxUC33/QBiuQMle3nBnAQXo02hW:HbF3vXxtXhGd3ozQMsU02h
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\aa6344a754a7b33cb7c6321f17399866.exe"C:\Users\Admin\AppData\Local\Temp\aa6344a754a7b33cb7c6321f17399866.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\aa6344a754a7b33cb7c6321f17399866.exeC:\Users\Admin\AppData\Local\Temp\aa6344a754a7b33cb7c6321f17399866.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.5MB
MD51fe471c96bfa72455c28f68a3547d51c
SHA10bd8df31e1674d78e3436a251842493d854a5bb8
SHA256cab8239ceeeec7a7ad1ea8cc5b0642f160b56589f1edf9eb308108239556e99b
SHA512755d79ad00cf3215ce231fbf82a2501f0e9f148cae138c00b77910bbd94ea5039214bf1d0b94bed7b358e726695f1bb70aedeb8486045e4441b83d2e47cb74b9
-
Filesize
4.9MB
-
Filesize
2.2MB
-
Filesize
1.2MB
-
Filesize
2.1MB
-
Filesize
2.2MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB