Analysis
-
max time kernel
90s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
27/03/2024, 13:05
General
-
Target
e1bd141dc7d48128d27f10ff1b27f5b3.exe
-
Size
2.9MB
-
MD5
e1bd141dc7d48128d27f10ff1b27f5b3
-
SHA1
1b90835a7f3a1a3f05d7bb84c287eb31650b7b33
-
SHA256
1fe8ea82da779acd9a142c238d4624b444176e1ce54fbd5689c47406357dbd78
-
SHA512
f92fac630c39df3e6e309e397291e55b10410b751e9c0740b3f2ae31ad2be6128d825fe8138dca77136042f5fb87af2a73686cfe5ea4409e3919eb8d8a5eb6e2
-
SSDEEP
49152:Y4hBPcz45QXs1iJ+S/SjiMOmN74NH5HUyNRcUsCVOzetdZJ:DBcVs1s+S/Sjpb4HBUCczzM3
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e1bd141dc7d48128d27f10ff1b27f5b3.exe"C:\Users\Admin\AppData\Local\Temp\e1bd141dc7d48128d27f10ff1b27f5b3.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\e1bd141dc7d48128d27f10ff1b27f5b3.exeC:\Users\Admin\AppData\Local\Temp\e1bd141dc7d48128d27f10ff1b27f5b3.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.9MB
MD54f016879c77e8f0964e7573a8f70d89e
SHA1676fff372e6bc6cd36504d73da38008ce31a3caa
SHA25687e09d9d7c31d3dcd6ef8865fa0de112c56b95196d7f8e1bcac738271aff61c0
SHA51258702bf9609966f40c7905be6478e62fde0799c6d228a6040550a21393e08db18359a6e78ebc65c5a7354176e14dadd5847fe6cdeec575e3fdb91e2bd1c3c087
-
Filesize
2.2MB
-
Filesize
1.2MB
-
Filesize
4.9MB
-
Filesize
2.2MB
-
Filesize
2.1MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB