Analysis
-
max time kernel
148s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
26/03/2024, 18:04
General
-
Target
dfc6f507a351383bf450a1ed51048da2.exe
-
Size
115KB
-
MD5
dfc6f507a351383bf450a1ed51048da2
-
SHA1
ea16269788d65105cc51f6221db74a356b6e8c69
-
SHA256
9a8b6ceabde7a501d5a417469b9768b441c158aa1a1418483779bbd4c418b346
-
SHA512
91f706aefc5b303fbd77a94a743cc076ff6939ca5a7588af52d302f715fcced9f1fbd7432306f9d083d3553607e84f0e02e35bbd68d585a833b655ad15230316
-
SSDEEP
3072:WSR8nKbjwQ26dbb6h54MpSrKb9oylCm/+ia8yzqbTuO:W4rjNxb6goKKbLlCm/Tkzqbi
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\dfc6f507a351383bf450a1ed51048da2.exe"C:\Users\Admin\AppData\Local\Temp\dfc6f507a351383bf450a1ed51048da2.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\dfc6f507a351383bf450a1ed51048da2.exeC:\Users\Admin\AppData\Local\Temp\dfc6f507a351383bf450a1ed51048da2.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
115KB
MD5f840f5f0b21325b6313aa66dd809fc9b
SHA1c2c8390afff81794cd6ef3a76b7669878718393f
SHA256eb355c8cfce72a73cee3d568185f1df105f0bda7cd120da41b439ceeb08012f9
SHA512d1ce97f1821f17cb3ffe8add69ac7827e82dad683bee5b582205cd8919f738e6c88100b50edcddc5bcd25fa08f8f92f3fe7974dfae54e7ed0e3760a97b46e91c
-
Filesize
468KB
-
Filesize
116KB
-
Filesize
116KB
-
Filesize
116KB
-
Filesize
468KB
-
Filesize
116KB
-
Filesize
56KB
-
Filesize
116KB
-
Filesize
468KB