Analysis
-
max time kernel
146s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
10-03-2024 09:58
General
-
Target
be510ec344af1ec3b9fc71a14c592f6b.exe
-
Size
5.8MB
-
MD5
be510ec344af1ec3b9fc71a14c592f6b
-
SHA1
e3382bbd2e7c8ac171048c4fb15bcfba5931aeba
-
SHA256
c26fd40f707b9f91fc3524f716ea9e858de4f41e967e36f88096918674536198
-
SHA512
733c8e4558ed685196f53fb44377df2fe06a41e21a1775cba6265dc8060fa64974a95e548c126b0093e9425358b13c5dbc64d0127f54f829f792851ece8276f9
-
SSDEEP
98304:vnyq2iy3sPYJgg3gnl/IVUs1jePsxLTCEXIDSdVfHPJ7zh0ygg3gnl/IVUs1jePs:693swPgl/iBiPeTCEXamxHP70Wgl/iBg
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\be510ec344af1ec3b9fc71a14c592f6b.exe"C:\Users\Admin\AppData\Local\Temp\be510ec344af1ec3b9fc71a14c592f6b.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\be510ec344af1ec3b9fc71a14c592f6b.exeC:\Users\Admin\AppData\Local\Temp\be510ec344af1ec3b9fc71a14c592f6b.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.8MB
MD5ca1dc70697bef5c1b3a3f349fb09cea5
SHA12aaa524f6779d98c5f405975818cfca66f3a9e93
SHA256172d38379580d5b665f2b7e345989336ba303bf10cfa255de07ff3488d323a23
SHA512b4de57fed70235abcef7e5fcf3a964313e17459ea2c8caf6342f70d0745aa82167e3ff7f105d00b5dee43428fe694b461e8b4a1c88806e2e373caf5c111b839a
-
Filesize
4.9MB
-
Filesize
2.2MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
2.1MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB