Analysis
-
max time kernel
141s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
12/03/2024, 13:14
General
-
Target
c37497683e028042debd07cc25c2ed57.exe
-
Size
2.9MB
-
MD5
c37497683e028042debd07cc25c2ed57
-
SHA1
15adf4330eb95974b010096660359d011041684b
-
SHA256
c063b5b566e5744ad7cb29a4416db801b362760243658d971b8633c8c9d7071f
-
SHA512
06c6136f59dcbe46f07d0b38f7783335a6941e1ec8c5f839a42ed959e7c69b98d28d9f3dd71ffbe95f8e1faa535193cee10173267bcbb12be60187d158ba3fea
-
SSDEEP
49152:9WZjL4X720ewNj5DkaUlGRShg4XP4M338dB2IBlGuuDVUsdxxjeQZwxPYRKs:Wj620wahRShZXgg3gnl/IVUs1jePs
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c37497683e028042debd07cc25c2ed57.exe"C:\Users\Admin\AppData\Local\Temp\c37497683e028042debd07cc25c2ed57.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\c37497683e028042debd07cc25c2ed57.exeC:\Users\Admin\AppData\Local\Temp\c37497683e028042debd07cc25c2ed57.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.9MB
MD58148496cbb05dd49ce66106c9dd4b0da
SHA1f4314b242d4a7a450735f4451958dfbf8f784141
SHA256931321df29bb1af9756f40d44be6519a95c86f04fce973b4802ce2069dbc6b8e
SHA51201f77a6d2aabac39b6c899e5c34e4f52d3cb0df8dc4e58f7a4f9614b784806b7085f262f43153fa1bfb68ae0603cdfa455575931afc1631d742ed681a657c475
-
Filesize
4.9MB
-
Filesize
2.2MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
2.1MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB