Analysis
-
max time kernel
148s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
15-03-2024 04:58
General
-
Target
ca8a797cf29c368c792cfaecc8264722.exe
-
Size
2.9MB
-
MD5
ca8a797cf29c368c792cfaecc8264722
-
SHA1
6d64043f5be5b1a066ac866dd2a3838373f4501f
-
SHA256
07f600b2993efd8d3926d5f1ec83b05c81d6bfefffdeac8a55170bf03efddb5a
-
SHA512
10775a69eaad274a29e88269714e861de7b0cbfa790ceacec37a4c3304c933f9d740f6f5e4a3086b992670391ba25f6af5a47a42378886b15fbc9ca6df7228da
-
SSDEEP
49152:8TdJ6xFXr7dUoq/Dy67P4M338dB2IBlGuuDVUsdxxjeQZwxPYRKs:8TdJ6xF77dUzNgg3gnl/IVUs1jePs
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ca8a797cf29c368c792cfaecc8264722.exe"C:\Users\Admin\AppData\Local\Temp\ca8a797cf29c368c792cfaecc8264722.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ca8a797cf29c368c792cfaecc8264722.exeC:\Users\Admin\AppData\Local\Temp\ca8a797cf29c368c792cfaecc8264722.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.9MB
MD5c8747ffc13b93665f2a2be1f27c3c2dd
SHA187c37b82b9db11400fb5c832c551056d9e6b05a2
SHA256d8518766c11334ba29b2dbcd2612cc265e43c85b55591facddbf06b85a7136fc
SHA512bb5ead8d8e36e6de3dabf3dba36e5ebd903f880b6aa69d1de00ff161a79e526091e91de1ab8de0490408ae10e516dec1cc581989c1f42f4ee6a4ecdc89e0c953
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
2.1MB
-
Filesize
2.2MB
-
Filesize
4.9MB