Analysis
-
max time kernel
149s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
25-03-2024 13:58
General
-
Target
de2cf002522a027f8c3131f37e519e05.exe
-
Size
115KB
-
MD5
de2cf002522a027f8c3131f37e519e05
-
SHA1
d94015451051ab9c9f2e7bec8d5d0349368ccad6
-
SHA256
7070d40aa507c62ba33b4e38302e3720f8b3b3d9085bb5047da64a513fe3dda9
-
SHA512
dbf52a4c370e0f9c8cae806827aa573bf9ab7fb8bf3c6c60ce3bfbff65831741f9141a6583192fcaaf114867a8a9c1f06208cb80648d179071f4c6eff9842a17
-
SSDEEP
3072:+veLkJ9VNegzClL+B98NMIRNq0R43lR3iZ/fXQJIDb2:+Y0HoYGSiqy43lYJfXsIb
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\de2cf002522a027f8c3131f37e519e05.exe"C:\Users\Admin\AppData\Local\Temp\de2cf002522a027f8c3131f37e519e05.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\de2cf002522a027f8c3131f37e519e05.exeC:\Users\Admin\AppData\Local\Temp\de2cf002522a027f8c3131f37e519e05.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
115KB
MD54929d7d6fbceb403b168bbdb05c6afd8
SHA11c1e3656f29fbd31aa2f0595ce1f2c95e0a6040f
SHA256bc9ee8d565a62ac8efbda88f3978baac5385416f7b808dd109c0404b08e321e4
SHA51236cd00f764b11973eab39f6d9729e32417e905511a66a021b88632df469dfe5e35f82eed001742a2aa558720cfdf694858d811dbaec24dcb73b296d13abddbcb
-
Filesize
468KB
-
Filesize
116KB
-
Filesize
56KB
-
Filesize
116KB
-
Filesize
468KB
-
Filesize
468KB
-
Filesize
116KB
-
Filesize
116KB
-
Filesize
116KB