Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
13/03/2024, 10:36
General
-
Target
c5a89fb709dac8648b0589f6a8c0403c.exe
-
Size
1.3MB
-
MD5
c5a89fb709dac8648b0589f6a8c0403c
-
SHA1
eb40294711786dcc539050b89a14de53af03234d
-
SHA256
61e0cd75f6e5f64646dd6e4f227ce24fe828e488de2f32f6d0953861ccc44872
-
SHA512
10bf33a2154348188e90e7b7cb94bea9a503701eb9c37d832bc6800cb6ca7985ff4caddabcf5f81a472f16ef63b339c0b941c4116e102be6989bad12db4e18af
-
SSDEEP
24576:biQVG8zhK6tO2+23V77a8waHe4+JmffFz2VCSA+Rep+OegsO2okY7yte9dmvG:ba89v9RRd+DmffFz2VQ4KDegd57yt
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c5a89fb709dac8648b0589f6a8c0403c.exe"C:\Users\Admin\AppData\Local\Temp\c5a89fb709dac8648b0589f6a8c0403c.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\c5a89fb709dac8648b0589f6a8c0403c.exeC:\Users\Admin\AppData\Local\Temp\c5a89fb709dac8648b0589f6a8c0403c.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.3MB
MD57a7815cacaa4ce2c60149aec8d7d9b13
SHA1b7c8577625a399b619660ddaefa0c90a8eb5d02e
SHA25631b66c885e5fc7e925a55739236967d4be2ad761082540352e0133d3c10b9c9e
SHA512622fadfc596ddf8577eb82f7afeb8aa936ea589f677a6b9b4c9d4ef3d02e946468e8a84a6ea3cb1caa0433ccec41977738548c41f2f5354dbb98dd4ee76c888c
-
Filesize
4.4MB
-
Filesize
1.1MB
-
Filesize
1.9MB
-
Filesize
4.4MB
-
Filesize
4.4MB
-
Filesize
1.1MB
-
Filesize
1.9MB
-
Filesize
1.9MB