Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
28/02/2024, 14:01
General
-
Target
ac0e34aaf646c26ac86591b63d1bfee5.exe
-
Size
5.3MB
-
MD5
ac0e34aaf646c26ac86591b63d1bfee5
-
SHA1
51a9933071ea0bbcb3cb38accc6f6b8856bef2d1
-
SHA256
409f81e7b2591047921af11661e3bd588239966fabc84f13db5664f5eb87cd44
-
SHA512
e0d83c6e6df036d4e05b8b2ee4e220c849a9fc6b589b452be3917a7ef1e6279b24acaedc8e5a6b2859122c708bd3f1171698bb71ac006f2f1691f2daf1a2733e
-
SSDEEP
98304:SscxD3pFomIox/9LIcDqyCFLbTx/9LIcD:Szx3+oDIc+yCFPTDIc
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ac0e34aaf646c26ac86591b63d1bfee5.exe"C:\Users\Admin\AppData\Local\Temp\ac0e34aaf646c26ac86591b63d1bfee5.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ac0e34aaf646c26ac86591b63d1bfee5.exeC:\Users\Admin\AppData\Local\Temp\ac0e34aaf646c26ac86591b63d1bfee5.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.0MB
MD5087dfe1a986c9ce3c025630b74c8d2b4
SHA1f1a7ff414f9da77762e80d8a66619d0f204ca7f8
SHA256befa5289c651144c3cc98347e6c30880ad4ce63b693e22e170def6a95791f4a4
SHA51272552c77ae1917a1161def9f71f0f392f5f2f168dfc08b75f318173755bc2747e6af1fd1b648dcf9e147da8c3063d6bc7949c0aceeb019a6b80cb4040a6fec01
-
Filesize
4.4MB
-
Filesize
1.1MB
-
Filesize
1.9MB
-
Filesize
4.4MB
-
Filesize
4.4MB
-
Filesize
1.1MB
-
Filesize
1.9MB
-
Filesize
1.9MB