Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
18/03/2024, 20:25
General
-
Target
d4727a99650ea5aa72147c4ab5f314d2.exe
-
Size
5.8MB
-
MD5
d4727a99650ea5aa72147c4ab5f314d2
-
SHA1
c2b34222b3f6008b008667a81b686400d0ae1fd0
-
SHA256
37153fc2d960092b34a1329a085e43b796a10406f6ecd576499457ae87712d59
-
SHA512
efdac063ef2d671c1b61b0e9760d37714adc982737372ebb56a2e3397a3e44855c84f2c2ad99cc253e4aeb4b2a513c90f261bb4fce73b8b6d3c89e5f01b7e0c7
-
SSDEEP
98304:bCqHH54HBUCczzM3lFQ02kPB/E4HBUCczzM3:286WCfQ02kP1bWC
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d4727a99650ea5aa72147c4ab5f314d2.exe"C:\Users\Admin\AppData\Local\Temp\d4727a99650ea5aa72147c4ab5f314d2.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\d4727a99650ea5aa72147c4ab5f314d2.exeC:\Users\Admin\AppData\Local\Temp\d4727a99650ea5aa72147c4ab5f314d2.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.1MB
MD5885fa539bb9582122c39f696584bc46d
SHA1981944648230796db5324acf0e2f32eb7c2a7dd5
SHA2567bcb1abf90818eb1dbe30628ef546e9eb529a5ad63f0ff1654415b60e9b75248
SHA5128877e3a50864841fc99029f5801f98d39fe082cbfba8c1edb73229d45945e9eb3538f1cec49171d773a1d9fa1f9d7496d5035179c36d03730371724ce21871d2
-
Filesize
4.9MB
-
Filesize
2.2MB
-
Filesize
1.2MB
-
Filesize
2.1MB
-
Filesize
2.2MB
-
Filesize
4.9MB
-
Filesize
2.2MB
-
Filesize
1.2MB
-
Filesize
4.9MB
-
Filesize
2.2MB