Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09-03-2024 14:35

General

  • Target

    bc0d9b263316bb636f51b2776ed8d4a3.exe

  • Size

    2.7MB

  • MD5

    bc0d9b263316bb636f51b2776ed8d4a3

  • SHA1

    99432f1cd28f0f02be9b8d4768b061c38f89bae5

  • SHA256

    1914124098ae620392080dc81fb97fe6025734316d772c3bab624703259176fa

  • SHA512

    2f321503d36550f032d44c688f3ddc6f33c22cc277a5185d10a3e338cad8fd3b3a1a998b091eb3dfe145f071c13f45064bc9c244aea01f8a27b79bc4f5ebc96f

  • SSDEEP

    49152:u3WxOP/4X6ixg8qaQ9nSoSS7IyCbxIEQADQsEp:u3/4qixg8qaQRSojeH79Ep

Score
7/10
upx

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\bc0d9b263316bb636f51b2776ed8d4a3.exe
    "C:\Users\Admin\AppData\Local\Temp\bc0d9b263316bb636f51b2776ed8d4a3.exe"
    1⤵
    • Suspicious behavior: RenamesItself
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:4676
    • C:\Users\Admin\AppData\Local\Temp\bc0d9b263316bb636f51b2776ed8d4a3.exe
      C:\Users\Admin\AppData\Local\Temp\bc0d9b263316bb636f51b2776ed8d4a3.exe
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Suspicious use of UnmapMainImage
      PID:964

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\bc0d9b263316bb636f51b2776ed8d4a3.exe

    Filesize

    448KB

    MD5

    4ffe118d19c33f93efb11dbb77b1af44

    SHA1

    aeb5987deffeda4faa35d08b387adcfed9b43688

    SHA256

    575394caae039c1b4309c9d03f04a47b04a904f5551d13b7bc6154b5e2119147

    SHA512

    5c0f0c8baca9fab177279dde546bd3b6da56ec67216f0df38bcc24e8316240a705b4379b442e0dd73b29102833ff6081732870f70549b1dfc829f98545e2094e

  • memory/964-14-0x0000000000400000-0x000000000062A000-memory.dmp

    Filesize

    2.2MB

  • memory/964-13-0x00000000018F0000-0x0000000001A23000-memory.dmp

    Filesize

    1.2MB

  • memory/964-12-0x0000000000400000-0x00000000008EF000-memory.dmp

    Filesize

    4.9MB

  • memory/964-19-0x0000000000400000-0x000000000061D000-memory.dmp

    Filesize

    2.1MB

  • memory/964-20-0x0000000005570000-0x000000000579A000-memory.dmp

    Filesize

    2.2MB

  • memory/964-28-0x0000000000400000-0x00000000008EF000-memory.dmp

    Filesize

    4.9MB

  • memory/4676-0-0x0000000000400000-0x00000000008EF000-memory.dmp

    Filesize

    4.9MB

  • memory/4676-1-0x00000000018F0000-0x0000000001A23000-memory.dmp

    Filesize

    1.2MB

  • memory/4676-2-0x0000000000400000-0x000000000062A000-memory.dmp

    Filesize

    2.2MB

  • memory/4676-27-0x0000000000400000-0x00000000008EF000-memory.dmp

    Filesize

    4.9MB