Analysis
-
max time kernel
148s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
18/03/2024, 16:59
General
-
Target
d40a5c7080b1d3b49cffa699f5e0d50f.exe
-
Size
2.9MB
-
MD5
d40a5c7080b1d3b49cffa699f5e0d50f
-
SHA1
e90e3cd8c3f146e8b0c804590e7d5580095aa2c2
-
SHA256
82f072d94b93f32e58e905da05f215baa8e4758f57ad30d2f08482063f9ed799
-
SHA512
fca98b9c340515f79f9d0e9ba5b51c2fe88769d5f679b57eb7cfb7fb3056f0bc8f2d7538e67e2e549094622d104b5f6cff0e31236c5039fd6231c1dee361445a
-
SSDEEP
49152:Uv6DBWGkJ2iX1wQhAfV6+2D0mhD9r6J8vM0aKMBwP4M338dB2IBlGuuDVUsdxxjl:Uv6WpvhCfPGpUJHBwgg3gnl/IVUs1jek
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d40a5c7080b1d3b49cffa699f5e0d50f.exe"C:\Users\Admin\AppData\Local\Temp\d40a5c7080b1d3b49cffa699f5e0d50f.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\d40a5c7080b1d3b49cffa699f5e0d50f.exeC:\Users\Admin\AppData\Local\Temp\d40a5c7080b1d3b49cffa699f5e0d50f.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.9MB
MD5dcd265dc58def8a990174e1a820564c1
SHA14e8f1bff682eedd05a03f0cfec1ae23a5ae038f5
SHA2562e1c24d4f9b9931882a9457d1df2849aa16ecd2e59624bf416d3f23468b60760
SHA512aa38c21ddfa24d4b4546da078f865297da1e7755bd04fca512d53e678b4ed7d9a07f215d4e7812e51476a9e97a9be75d6b5aaee4ff4e41f2473987daee2f01f0
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
2.1MB
-
Filesize
2.2MB
-
Filesize
4.9MB