Analysis
-
max time kernel
150s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
26/03/2024, 10:12
General
-
Target
dee9927780245873a179f0ac37e2e20f.exe
-
Size
3.9MB
-
MD5
dee9927780245873a179f0ac37e2e20f
-
SHA1
292e6dc6193983f2dc4240fb9ae94cf61d4f1bcd
-
SHA256
3a6fe2e056ccfeead8d38f2347db08d385a087fa8d17f6a8183e5cc10baaff98
-
SHA512
b3bb6bd21f2466c303e7ad4eb68ddc0524f2b0b351b39af74282d0ebc857590a9d0f09cb264c58ee86dcef34f4f195dcc32fd3d68377a8dc6b8a9f1e84e06a00
-
SSDEEP
98304:wgVp7D0Jl4Megg3gnl/IVUt4pJWzZtIygg3gnl/IVUV:wIn0Jl4Mqgl/iwgWttJgl/iG
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\dee9927780245873a179f0ac37e2e20f.exe"C:\Users\Admin\AppData\Local\Temp\dee9927780245873a179f0ac37e2e20f.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\dee9927780245873a179f0ac37e2e20f.exeC:\Users\Admin\AppData\Local\Temp\dee9927780245873a179f0ac37e2e20f.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
785KB
MD5be1de5ce46ab118dc3d5bf7f38ad4f33
SHA14cd6d167859b4b49ee06426ed54ba27fef0c58ab
SHA2565a2373943a12efffc0f192fb902b59036d29aecf27417b7a0dee8800d313b2c9
SHA5125754b1a6ec9b277e65d459cf7e54af300203a844f73fc77505b3c67a318470ca1ee54761607d25c2774729f91a076af9cf33d35ee9a49ba8945dd09bac24ee60
-
Filesize
4.9MB
-
Filesize
2.2MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
2.1MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB