Analysis
-
max time kernel
146s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
16-03-2024 11:12
General
-
Target
cdeaf48bc44598a23f7d46900bbfe8d6.exe
-
Size
2.7MB
-
MD5
cdeaf48bc44598a23f7d46900bbfe8d6
-
SHA1
f3fd13a9c0df1eed9825c8db3d535404a93fae14
-
SHA256
3360a76baf0a322e7dbf499ffae46883f16dff3dbd04b9088e61800682b03445
-
SHA512
5d285224a132c39d64355e2e5099ef489fe4a35c77f15bec91a4e32db57ae541c360c1607ae8278de1953fd7a365ab0df238759a7baaeea063ba83077c247abc
-
SSDEEP
49152:scUYroe2ViGXc4ODkCC6w6252YHuD3daeR9YdLnm9KOcDvOe0tUIZl3R9j:uYroXViCJODkCCK24iuD3dpH4mk7vTbK
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\cdeaf48bc44598a23f7d46900bbfe8d6.exe"C:\Users\Admin\AppData\Local\Temp\cdeaf48bc44598a23f7d46900bbfe8d6.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\cdeaf48bc44598a23f7d46900bbfe8d6.exeC:\Users\Admin\AppData\Local\Temp\cdeaf48bc44598a23f7d46900bbfe8d6.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.7MB
MD56670b471764727e9d7affb124540bd78
SHA125245417a3d02c373bfa54882043fe3d0b113bbf
SHA25680cbc9218a7c740cd3f042097e42f5f4f9b5b0d6d29534e2f1e5bd679b961c5e
SHA512f1015b42dd3851c40eb76c38c7c7a48be6f6d7d536fbfc3b189f9c6ae295a83c6546ee6d228cce31be7fbe61bb128dde71f5d4c3aaba3ceb50a9a229894b93b3
-
Filesize
2.1MB
-
Filesize
1.2MB
-
Filesize
4.9MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
2.1MB
-
Filesize
2.1MB