Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
14-03-2024 11:09
General
-
Target
c878cb9e8bfd41799ce07f395c608291.exe
-
Size
10.6MB
-
MD5
c878cb9e8bfd41799ce07f395c608291
-
SHA1
9588294685f5e150ef70e85dff665478137e11a3
-
SHA256
62b517657093817aa5f9ee70e5fcaa0b9ad2a5cf03c485a795137329f5010aea
-
SHA512
b0582ac34383a084228a212e973f6222c44d3e906e8520d3df00bb25907400d0ac61f235c5fdf0f33255c930147fba00d329f555bee744acc6cff8f73b7530d3
-
SSDEEP
196608:v1biWd80v38aXMBkEyv1rLu0v38aXMBg+/wE4Dzwc0v38aXMBkEyv1rLu0v38aXw:dicrPbT1/lPbzEtLPbT1/lPbA
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c878cb9e8bfd41799ce07f395c608291.exe"C:\Users\Admin\AppData\Local\Temp\c878cb9e8bfd41799ce07f395c608291.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\c878cb9e8bfd41799ce07f395c608291.exeC:\Users\Admin\AppData\Local\Temp\c878cb9e8bfd41799ce07f395c608291.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
10.6MB
MD517b60302f5867dbeb03d671b9f377647
SHA1bacba41c6612fb3228006bf61bfa371f8b386524
SHA256b737c901420aea5014d3316dfa6ea2b83d01fa20ba2ad6eb6a4a4a94d3b9b94f
SHA5122f603582d8330347d8740b9e08713c71374444252f7d65af0238c280ec9c1841a27cdc501689f0d291ad6071a882435a00ac64bb4ec8d41a0a45a49911fe50cb
-
Filesize
4.9MB
-
Filesize
2.1MB
-
Filesize
1.2MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
2.1MB
-
Filesize
2.1MB