Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
06/03/2024, 04:33
General
-
Target
b6843c3c13f4f2c00e6bf522f2ea4b5d.exe
-
Size
1.5MB
-
MD5
b6843c3c13f4f2c00e6bf522f2ea4b5d
-
SHA1
866fec16e4d9ba922f08e6739c6fdb85043fe0d1
-
SHA256
76d6d25f890ec17ee67f5524cc46a6e4ef2aed36ac4785b95611459716b4fb3f
-
SHA512
61f398309aaa7415c2ec24364d03e530d33c7d796bd2a491d9aecb72ef04305b9570fc6aedb3585b7b021e86854936a28fddf206ade13e7b0e7c81bd0fbb5ee7
-
SSDEEP
24576:Eithluy41m4ey5F5rmZEP3J9O6idQbNuJV9fkhmfZskWW:TM91RrT405bNuJV99PW
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b6843c3c13f4f2c00e6bf522f2ea4b5d.exe"C:\Users\Admin\AppData\Local\Temp\b6843c3c13f4f2c00e6bf522f2ea4b5d.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\b6843c3c13f4f2c00e6bf522f2ea4b5d.exeC:\Users\Admin\AppData\Local\Temp\b6843c3c13f4f2c00e6bf522f2ea4b5d.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
256KB
MD507a230623f85ea29c0e526fd5ea2e167
SHA109127fc52fcfacc14c5ecaa759b45aaed44c4915
SHA2563d5ba2098d433e40685260c6cf42bd14175e8ae856afb683a69f46f32eed5d60
SHA512de1bfa79aea1a05ba084ef25fb0885b99d104cc481647ccc3170b5d977a9d939efd2a6025a5e181a23e026f4cac456240461e27bd5153bbebe0a1b2faa002d59
-
Filesize
4.9MB
-
Filesize
2.2MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
2.1MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB