Analysis
-
max time kernel
91s -
max time network
122s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
13/03/2024, 06:07
General
-
Target
c52a6f37e8510afa54037a55836a1a5e.exe
-
Size
2.9MB
-
MD5
c52a6f37e8510afa54037a55836a1a5e
-
SHA1
57251269872ef16ba2622be65afa8831ad9180b2
-
SHA256
718754ef3ad315893ce458500c3005dc76d1c0ce39e6ccfac2c356fb0f130065
-
SHA512
03bffe43c01043506e86c900e09ce8ce433d28ddcaf03fd6a6bad141fd3dd9ddd39b5bc4a451c4a2c7d1492869240f1ec437ae413857c4503d66b0289dc23205
-
SSDEEP
49152:zvvVARODHM4HeOCq9WPeNIw2ngWDHVXrL0SfBDyxfl/2d/f819WuQyzESAg2:j04T9WPwIw2gG1XrISfBOZ8d/f+9g5SK
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c52a6f37e8510afa54037a55836a1a5e.exe"C:\Users\Admin\AppData\Local\Temp\c52a6f37e8510afa54037a55836a1a5e.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\c52a6f37e8510afa54037a55836a1a5e.exeC:\Users\Admin\AppData\Local\Temp\c52a6f37e8510afa54037a55836a1a5e.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
633KB
MD5ce782063383f7b85819eab88f08b6f16
SHA178985800a2c05beab5b9c03e758a9b00a3b55477
SHA256875a689a6589267d17ae31c58ab298ab880538b239dcdc66553db65efef79c33
SHA5122140e26a138023fcf7217abfd86defad79b223f2876dfe1691bce371ddf8d5324046b8a8dcb59d9da1b1f3c43061595751d902de200ef30e7e953b37303f2df2
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
2.1MB
-
Filesize
2.2MB
-
Filesize
4.9MB