Analysis
- max time kernel
140s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
10/03/2024, 11:41
General
- Target be856be9a630bf4cca54d67ec7c67dca.exe
- Size 5.3MB
- Sample240310-nth87acb91
- SHA256 180cf13dc53925e37723f623152ba6eccf8879d9650057aa896cbaf50d017048
Score
7/10
Malware Config
Signatures
- Deletes itself 1 IoCs
- Executes dropped EXE 1 IoCs
- UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Suspicious behavior: RenamesItself 1 IoCs
- Suspicious use of UnmapMainImage 2 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\be856be9a630bf4cca54d67ec7c67dca.exe"C:\Users\Admin\AppData\Local\Temp\be856be9a630bf4cca54d67ec7c67dca.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\be856be9a630bf4cca54d67ec7c67dca.exeC:\Users\Admin\AppData\Local\Temp\be856be9a630bf4cca54d67ec7c67dca.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3804 --field-trial-handle=2264,i,15001568551143786084,90255922961447677,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
be856be9a630bf4cca54d67ec7c67dca.exe
memory/3100-13-0x0000000000400000-0x00000000008E7000-memory.dmp
memory/3100-15-0x0000000000400000-0x0000000000622000-memory.dmp
memory/3100-14-0x0000000001D90000-0x0000000001EC1000-memory.dmp
memory/3100-20-0x0000000005680000-0x00000000058A2000-memory.dmp
memory/3100-21-0x0000000000400000-0x0000000000616000-memory.dmp
memory/3100-28-0x0000000000400000-0x00000000008E7000-memory.dmp
memory/5108-0-0x0000000000400000-0x00000000008E7000-memory.dmp
memory/5108-1-0x0000000001C50000-0x0000000001D81000-memory.dmp
memory/5108-2-0x0000000000400000-0x0000000000622000-memory.dmp
memory/5108-12-0x0000000000400000-0x0000000000622000-memory.dmp