Analysis
-
max time kernel
147s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
27/03/2024, 20:26
General
-
Target
e245072c50fbb4eb419fe16bc299878b.exe
-
Size
338KB
-
MD5
e245072c50fbb4eb419fe16bc299878b
-
SHA1
81629cfd7dad9a5b914625354a09f58cad246a55
-
SHA256
1010a1abe8696de78276b4441668b1050f837745b0f66a55f1593ae84b09822f
-
SHA512
72af54b036a4375ae547629fa99c331e55d3f0e9bbae03d1953f3fd2151fdbc956e74003d1ce6d3f55b69514bbdd0be23feae9623c5909d78b98e56c02f9be2d
-
SSDEEP
6144:yr7VFmZVhsiGyEPfkJ+F2gX975jUEeseUTUXdAqFhTHbH5vA5ANmYWGP+F2gX97S:yrOLOiGpna+F2gX9JeseEUi+hr7a5AX7
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e245072c50fbb4eb419fe16bc299878b.exe"C:\Users\Admin\AppData\Local\Temp\e245072c50fbb4eb419fe16bc299878b.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\e245072c50fbb4eb419fe16bc299878b.exeC:\Users\Admin\AppData\Local\Temp\e245072c50fbb4eb419fe16bc299878b.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
338KB
MD5a66a065b8544106aadc86b59a9a56f0a
SHA17fb269d43b9496b2bd4fdf0f42157fb17f6ea9ed
SHA256d58b658d2a81ae7cce2b0bb5402b4d64971a7129e5e259c835ba5a8884f713f1
SHA5126b194dff153f91fea4a737b8d8d4d66e49f2e51909bb4f5b3fbf89d1d35cd3379f77b96d1254ae13c2572162cd2daa72ec12028fc5127043bd2a6ef86ab38fe3
-
Filesize
188KB
-
Filesize
56KB
-
Filesize
188KB
-
Filesize
108KB
-
Filesize
188KB
-
Filesize
188KB
-
Filesize
108KB
-
Filesize
108KB