Analysis
-
max time kernel
148s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
10-03-2024 03:45
General
-
Target
bd94d53519522620d34093ad46c8a2cf.exe
-
Size
10.6MB
-
MD5
bd94d53519522620d34093ad46c8a2cf
-
SHA1
fd94d49e281d577e89112094b6c9c755833a7f19
-
SHA256
a9beeddac3f60a34217513bb946e40abbc341d988815e97b04b7823e9f744336
-
SHA512
8e0e2b5c04f5d5faf2623176ae1331a169ef6d189833ed0eeeebbcc810b5c087536e550d2349647cb28546675ef02a2d16cd4b60afb79f46e9f0e8ee548f8221
-
SSDEEP
196608:MCDXueYKpfyxu4maPyZI2Y52qOtOXKpfyxu4maPyjs5tSKpfyxu4maPyZI2Y52qW:lxtyxudTEO9tyxudItTtyxudTEO9tyxU
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\bd94d53519522620d34093ad46c8a2cf.exe"C:\Users\Admin\AppData\Local\Temp\bd94d53519522620d34093ad46c8a2cf.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\bd94d53519522620d34093ad46c8a2cf.exeC:\Users\Admin\AppData\Local\Temp\bd94d53519522620d34093ad46c8a2cf.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8.2MB
MD537013379cc6f35cfa486777f916e2957
SHA1f7383d74a4a4d489182a810ea5699ebbc2ee2150
SHA25652722a746d28bcc4e0fcf1322bd35f6ff623619e85f232cfe11467d77498e7a5
SHA5129d1b3bcd6b9c4e73be8d75f42680567d5608404b4915c9eb9bb20ece1dd53d53732caf4cff51573b1d4c9a2c9c7837b08f6d54783131fd07b52592a228aa2171
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
2.1MB
-
Filesize
2.1MB