Analysis
-
max time kernel
135s -
max time network
128s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
16-03-2024 05:05
General
-
Target
cd2ea28f251bb8dfcae95d482aa276f6.exe
-
Size
2.7MB
-
MD5
cd2ea28f251bb8dfcae95d482aa276f6
-
SHA1
ab9642598b39e273da11080fed3363a88c080285
-
SHA256
01ff58daf1109078a418a106d552a3b2430c34ec4db00640e0ac788559f045e3
-
SHA512
07771a4c757a6f71bd5601063f2604b043bbcc6d051db707cfd2e3bffe457a902d4276d1331ca5a3cb35d382fb291cdeafd4dc116898d60726512d2d65cbdff4
-
SSDEEP
49152:Q2P4twGL+POtyIr+E2pNr7XJR9W/jZdc7ngQxJwC1SM2xqAmVVYuwN+S8zR9j:tBGL4OUbJH4jZ67SQEqAmfRS8zHj
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\cd2ea28f251bb8dfcae95d482aa276f6.exe"C:\Users\Admin\AppData\Local\Temp\cd2ea28f251bb8dfcae95d482aa276f6.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\cd2ea28f251bb8dfcae95d482aa276f6.exeC:\Users\Admin\AppData\Local\Temp\cd2ea28f251bb8dfcae95d482aa276f6.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
896KB
MD57de4b6125c91b29a96f4a3fd5187475b
SHA15fea5321acfee9a33387fa6d353aed211e53abc0
SHA25647fdca66ed6aab43e46d36223e89561807d0d6e8e2a79f1e2deb123f681d4ef2
SHA512074e1e86383cae31d8949d116202c05fc1c68054ce06a78d2fb5f4f33e907213a4359fd517baf4eb4973c114cf22c26556deb8d0dc11a9149161f7902a393bf9
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
2.1MB
-
Filesize
2.1MB