Analysis
-
max time kernel
136s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
11-03-2024 16:22
General
-
Target
c10b3a1eff3a14cc8a4d4b599c98f30e.exe
-
Size
5.3MB
-
MD5
c10b3a1eff3a14cc8a4d4b599c98f30e
-
SHA1
b425a25528a1e68f02971c5f1d6458483e82991d
-
SHA256
a9735e725175a2401ac575de1b9642e97857568e1daf07033ebb02d9e02fd8dd
-
SHA512
4b08c1018bfd509ef1eba41ea0d706132f06bd24ead78303d88f1817c3318265413205ba498a663b3c6b79b3cfe6a7221a8fd8ca70a634e69c473637d08f6958
-
SSDEEP
98304:yFTQglsIcFdHHktBcwQDM2YIDULHXq43yNDfHktBcwQDM2YIDULHt:qcgl4FdHschDHIaP1fschDHIN
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c10b3a1eff3a14cc8a4d4b599c98f30e.exe"C:\Users\Admin\AppData\Local\Temp\c10b3a1eff3a14cc8a4d4b599c98f30e.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\c10b3a1eff3a14cc8a4d4b599c98f30e.exeC:\Users\Admin\AppData\Local\Temp\c10b3a1eff3a14cc8a4d4b599c98f30e.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.3MB
MD50e0ea4551051b7726639f3a26599345b
SHA109e990c67c0176fc0effbf3d91f9cd732a296e64
SHA2566c8aa361ecf925b4161751cf150c0a56bd352a43531885e68e1b869f444198a3
SHA5122b3fbb333d54641330630dabd96ba047042b4aed047c92f36fe0f820102c930dc3c8e05a01fe8f03f7e67029baa777c5643715b358b4e39efde4b49d49237f55
-
Filesize
1.2MB
-
Filesize
2.1MB
-
Filesize
4.9MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
2.1MB
-
Filesize
2.1MB