Analysis
-
max time kernel
147s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
14-03-2024 01:03
General
-
Target
c74a5a3f523a7ade076609846e642f36.exe
-
Size
2.9MB
-
MD5
c74a5a3f523a7ade076609846e642f36
-
SHA1
1f99682fa21bfea987fb1211e41c1551e7e07864
-
SHA256
981fb39056b134f69da82b778945162bf276edcddc5ab2826f9660418fafb2f7
-
SHA512
d2edac71c8df9d93d4365dedc9394ce4ba80c5516db47dc6f832c8fa5d472b22f94359461b5e1411b40df8d0f8af963864365e8da8c8849dfb35cb77f62f75c1
-
SSDEEP
49152:SZe+cOGCgpdU6dQH/4aw38Ty4q9KiUP4M338dB2IBlGuuDVUsdxxjeQZwxPYRKs:ueKGCgpK6d8bTyUNgg3gnl/IVUs1jePs
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c74a5a3f523a7ade076609846e642f36.exe"C:\Users\Admin\AppData\Local\Temp\c74a5a3f523a7ade076609846e642f36.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\c74a5a3f523a7ade076609846e642f36.exeC:\Users\Admin\AppData\Local\Temp\c74a5a3f523a7ade076609846e642f36.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.9MB
MD5d213c24a9d06ee4d550fe6bc46928425
SHA1f6967b4c7284c56689b9f63d72f3a722420f866e
SHA256c5894ed6fd21dc5b6e4f32949a3aeefcfd8d92b6bc996625de80b75f3210a80d
SHA5120f3381dd1347563a6524729e02c63f608a704b33974ae963fdf371d0dff1ca384d4fc7acaeea8adb6b1a628ed9028f1acec21a5517afd93ac966fe32c62e8f36
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
2.1MB
-
Filesize
2.2MB
-
Filesize
4.9MB