Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
18-03-2024 18:37
General
-
Target
d43abf6676c3a06973957c2e2e4e3e14.exe
-
Size
2.7MB
-
MD5
d43abf6676c3a06973957c2e2e4e3e14
-
SHA1
aa402485a3f036f21665cb5a12fd2b8896f52a35
-
SHA256
93d21bedee91db96075be2f95d64c42ad7070eb6e6967f4037b068e8ddc76202
-
SHA512
c5585b90cd5e2a9cec920197d756461916520905d3e41034cf4c1549ebe9a9596256b5d89297411622d26caefc594e4f0bba32e21cbf418580f1a3b153e1046c
-
SSDEEP
49152:s/jAkR5xJolkAjn5/dpIhGR9LA229nRNePftMjjgUfM3hvquoRv4R9j:s/LPJsj5/rIAHL96EPCvtfsJyv4Hj
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d43abf6676c3a06973957c2e2e4e3e14.exe"C:\Users\Admin\AppData\Local\Temp\d43abf6676c3a06973957c2e2e4e3e14.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\d43abf6676c3a06973957c2e2e4e3e14.exeC:\Users\Admin\AppData\Local\Temp\d43abf6676c3a06973957c2e2e4e3e14.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.7MB
MD54df02f79f270f0627e698fe424b97ddf
SHA11585deb5e3692ac5cd15966860a0f4f3a4de166a
SHA25649348de7ba1047542fd90a16528d380a8802af4d497dbb25b2413fc83bb00de0
SHA5123f483a62d3b5bc2008450089bd456addd81bc4ae6e187daa10b0522188c0da4ea8f7ec35017e12e4b2740be2c898d75dc8fb9a52a72def4b1a37839fbe3212bc
-
Filesize
1.2MB
-
Filesize
2.1MB
-
Filesize
4.9MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
2.1MB
-
Filesize
2.1MB