Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
18/03/2024, 17:44
General
-
Target
d42111a3c173a262cb866eea685f42eb.exe
-
Size
1.5MB
-
MD5
d42111a3c173a262cb866eea685f42eb
-
SHA1
519716075040f31ac46c9592988108ca0358c43c
-
SHA256
17c5f0cfa7787b5f847085d196abada538c015f9b7cd610bdb0c0b6bbdac298c
-
SHA512
9fed7f0f791795e0c7774845348677c1d75f9c6a77c38e9ad3966b9429a8a15559c9579fca674778d47b4062c52b1128e00b03e0005afc31f6ababd661f24105
-
SSDEEP
24576:CVjGBoP0z8qAQZq0dUt4/DadzYnWR/79I3B4FPiz8vv9oLE5+AmnpxM70VmnLVyW:CVSBoPs+teDadMWR/79Ie17v9WE53mnj
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d42111a3c173a262cb866eea685f42eb.exe"C:\Users\Admin\AppData\Local\Temp\d42111a3c173a262cb866eea685f42eb.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\d42111a3c173a262cb866eea685f42eb.exeC:\Users\Admin\AppData\Local\Temp\d42111a3c173a262cb866eea685f42eb.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.5MB
MD5e7fe88925758f8ceca279c5868f7b265
SHA1a58d23e1655b9edd6f86453424bc2907da0a7136
SHA2561ec5e4663795be94880f40b80855aee0cb8ec96443e0f6a4fb397713b0ef3dd6
SHA512eab45feb3d1a310a5d95650dfc79307666d56fbb3b74754362f73e9db46c82a4254d4b1494e87cba3f90b8f4c46de36c8e375632c8643ea2e9158f3ee17a1349
-
Filesize
1.2MB
-
Filesize
4.9MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.1MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB