Analysis
-
max time kernel
90s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
13/03/2024, 04:28
General
-
Target
c4f88f65d8a8b5665d0876cd83342e2e.exe
-
Size
2.7MB
-
MD5
c4f88f65d8a8b5665d0876cd83342e2e
-
SHA1
c07fdb57ffc16e0fc445cdb429367cc1161bc7e9
-
SHA256
b2a9ff1199dd38900cb7e9becf671e69d27528b81aa04cfa6cfd685cb4a889f8
-
SHA512
0355e548cd2428b6b15ac9529fea9c470f0295a187efbf342057248a4d2e926da8d4cc81b0e7632e5479e0cc0785d514773674fe67866b5b9ff1b70e1e11454f
-
SSDEEP
49152:byed17lNcyVAvaAoRczNr6W9DR9cF5OonzWMnpMax+SW0IcWpAfejR9j:byQ7lqlSsd6OHcFoLWT+SW0xWvHj
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c4f88f65d8a8b5665d0876cd83342e2e.exe"C:\Users\Admin\AppData\Local\Temp\c4f88f65d8a8b5665d0876cd83342e2e.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\c4f88f65d8a8b5665d0876cd83342e2e.exeC:\Users\Admin\AppData\Local\Temp\c4f88f65d8a8b5665d0876cd83342e2e.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.7MB
MD5d9e173cf330c472d58d3a7d439454a13
SHA10c9f1e44222a974f720d1b4bef6cef4f8ace804b
SHA2564806a8818d802b5c6d9960a2d5f32d4862c854efb9eeabaa245feba934bba6dd
SHA5122b2a54699df2a82025cf54f02f8c75cf007bf7abd9cde2b2c263f7188bc0ec18c867dc37859b8e38cce936ac8733ffce2cef2d55fbcf700841410a7c498796db
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
2.1MB
-
Filesize
2.1MB