Analysis
-
max time kernel
149s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
19-03-2024 15:25
General
-
Target
d6750cb03545797c0070dfdeeac8c25a.exe
-
Size
2.9MB
-
MD5
d6750cb03545797c0070dfdeeac8c25a
-
SHA1
4acd40870186dfe0b13edee4240ebc1d2071400b
-
SHA256
06b83b6bc1f6e2ba80f84f9749c234b0075b2157bec1c387add12b87b81eaac9
-
SHA512
77c827d7d269ac1eaabb087b639ba69ce716d59fe2be99034a92b87dc1a56aa35eefd7878fd9bbc891b171647a01d55c2d2dc62b6898ccdc538ffdf8ea19cf05
-
SSDEEP
49152:W5O9JB/DqZqs3LKrJrFM6s3cp8IP4M338dB2IBlGuuDVUsdxxjeQZwxPYRKs:DBDqD3LKrJhZsMp8Igg3gnl/IVUs1jek
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d6750cb03545797c0070dfdeeac8c25a.exe"C:\Users\Admin\AppData\Local\Temp\d6750cb03545797c0070dfdeeac8c25a.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\d6750cb03545797c0070dfdeeac8c25a.exeC:\Users\Admin\AppData\Local\Temp\d6750cb03545797c0070dfdeeac8c25a.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.9MB
MD5bdde42b5104cb68095f9571f1824195a
SHA16fb0e1f9dc170140590f66d6b4de4f0bc7be9be2
SHA2566c16ff178e2c295a8db90270d9ce90062ac8318e4d2bdd8804f1e71fc246081c
SHA512ffe9c8cbef1c0e41141d16032f529a239501a84be2f9088a2459ffee557d308d79148c98baad868d2f30e5767dfdbe376c8d64b88beab6167b0124f7c77e2d67
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.1MB
-
Filesize
4.9MB