Analysis
- max time kernel
150s - max time network
157s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
13/03/2024, 04:19
General
- Target c4f434ddfed6671a6441a454ae6640bb.exe
- Size 5.8MB
- Sample240313-ex2p9sce7v
- SHA256 de29ed4a465eb3c067a06740de4f74c792684759d966fdb689afed8676d7076c
Score
7/10
Malware Config
Signatures
- Deletes itself 1 IoCs
- Executes dropped EXE 1 IoCs
- UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Suspicious behavior: RenamesItself 1 IoCs
- Suspicious use of UnmapMainImage 2 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c4f434ddfed6671a6441a454ae6640bb.exe"C:\Users\Admin\AppData\Local\Temp\c4f434ddfed6671a6441a454ae6640bb.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\c4f434ddfed6671a6441a454ae6640bb.exeC:\Users\Admin\AppData\Local\Temp\c4f434ddfed6671a6441a454ae6640bb.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
c4f434ddfed6671a6441a454ae6640bb.exe
memory/872-0-0x0000000000400000-0x00000000008EF000-memory.dmp
memory/872-1-0x0000000001D40000-0x0000000001E73000-memory.dmp
memory/872-2-0x0000000000400000-0x000000000062A000-memory.dmp
memory/872-12-0x0000000000400000-0x000000000062A000-memory.dmp
memory/1312-13-0x0000000000400000-0x00000000008EF000-memory.dmp
memory/1312-16-0x0000000001D30000-0x0000000001E63000-memory.dmp
memory/1312-14-0x0000000000400000-0x000000000062A000-memory.dmp
memory/1312-20-0x0000000005630000-0x000000000585A000-memory.dmp
memory/1312-21-0x0000000000400000-0x000000000061D000-memory.dmp
memory/1312-28-0x0000000000400000-0x00000000008EF000-memory.dmp