Analysis
-
max time kernel
101s -
max time network
102s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
-
submitted
15/07/2024, 09:25
General
-
Target
ba9a6f354e9e8f5be652a5bc10e6af60N.exe
-
Size
59KB
-
MD5
ba9a6f354e9e8f5be652a5bc10e6af60
-
SHA1
079bb11b606fe93d8343b00293bd809b15694ac1
-
SHA256
fd588a4df87618f3822bd4f7f60e58cf97a8b75a8eaabe8668406ace5cbaf0f2
-
SHA512
99122c1b5f28e90bb1ee1a5a0ead4607fefdffe6cd34e02adf9bbda17cc0a783c005a09a7a104fd649c0269db321ca7b3bde4e315193db4cc3d2f4987d62baa4
-
SSDEEP
1536:Zcp13tH9T/O5+L2FC2NB3dwvkP0HJt9QVTsMCe4K4ky:Zi9tH9T/O5+4C2N1dwvkP8t+Tu
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ba9a6f354e9e8f5be652a5bc10e6af60N.exe"C:\Users\Admin\AppData\Local\Temp\ba9a6f354e9e8f5be652a5bc10e6af60N.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ba9a6f354e9e8f5be652a5bc10e6af60N.exeC:\Users\Admin\AppData\Local\Temp\ba9a6f354e9e8f5be652a5bc10e6af60N.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
59KB
MD5bc06672b5e13cfef3193e001e73fecf4
SHA175eb51c753d519a89dfb6fd86ff00cdec00a63f5
SHA25684ecffecefbf6ddf768230e7b854c1fc39a16c139d24401c9d5acd9d92a4a750
SHA512ad1384f2242f86e6ebb7d99fd390e267a42437171e68375884cb247ead0f4338f9c04d70b7b6e482f1a5ac8863f6da0e2d3b06941f324f616be3079d78c4d2a6
-
Filesize
244KB
-
Filesize
116KB
-
Filesize
60KB
-
Filesize
56KB
-
Filesize
116KB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
60KB
-
Filesize
116KB
-
Filesize
116KB