Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
19-03-2024 07:06
General
-
Target
d580b3602b516cbc90da67feab24af5b.exe
-
Size
1.3MB
-
MD5
d580b3602b516cbc90da67feab24af5b
-
SHA1
9c92b76a09ac6974a45305c8bd8f94a60c977c50
-
SHA256
119e7dc97657bafae8f25a38a6a1efe32c067d7302f0a1e3419a906e8be6cde2
-
SHA512
89042770858423841cf9d2e8099aee587673be9d14c46824310cb178f8cb45dbb5b1da5dda1a39ce0304f8db631de6c1bbbc478be98aaf60d62dd73cab64d375
-
SSDEEP
24576:fa/AnVEkmbSlZbDDLEYQhEu7SgMk5xAoBeD4cKVVBOvOWO:CoEkkSlZbvg3hF7SgMkngD4FvBIOf
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d580b3602b516cbc90da67feab24af5b.exe"C:\Users\Admin\AppData\Local\Temp\d580b3602b516cbc90da67feab24af5b.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\d580b3602b516cbc90da67feab24af5b.exeC:\Users\Admin\AppData\Local\Temp\d580b3602b516cbc90da67feab24af5b.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
MD545e700e8d052e051e1ec1b67aaba0b23
SHA131dcec0b977daad3ad07b4bca117845c5b97dd55
SHA2567a7713ff30371f107799c7f3753302ed7c4ad1d9c2e53f421dcb0f7cd0fa4662
SHA51215e9d31173434e1753d76c2f7d6d2b734e96d706bf9a0aaadee7c8860a9fbd38548e0b1e8f99e275a23fe184359ce73343ccfc9617b13e91c4d88920987e6e4c
-
Filesize
2.2MB
-
Filesize
1.2MB
-
Filesize
4.9MB
-
Filesize
2.1MB
-
Filesize
2.2MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB