Analysis
-
max time kernel
122s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
-
submitted
22/12/2023, 10:48
General
-
Target
863749db0174fc590d17a8230adbb190.exe
-
Size
116KB
-
MD5
863749db0174fc590d17a8230adbb190
-
SHA1
2f7949d6983c9e3e62c1fed25e4f7c4cdc30c70c
-
SHA256
e448aea2db268bb236f337f69230e23e2126d63a7d356c5efcdfaf2ea31c1120
-
SHA512
04fa6da39aff941355098ef5f9e0191d19c96a100357ed2a0fb93d012df30adaaedde043eb3953c47c274dcbedfaeb47477970621b7fd920b7eacbbf3ce38cea
-
SSDEEP
3072:6zZwFzmY5dYNa+gq/d0d/QqVBA/A7C0LyPTmXRLu:mxYtqSogB/7r+P8k
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\863749db0174fc590d17a8230adbb190.exe"C:\Users\Admin\AppData\Local\Temp\863749db0174fc590d17a8230adbb190.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\863749db0174fc590d17a8230adbb190.exeC:\Users\Admin\AppData\Local\Temp\863749db0174fc590d17a8230adbb190.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
116KB
MD5859d12714b343bb195500a75bd9043d3
SHA14958af96c8859890a83bd9ee374b7ba22828f3a2
SHA2563d86e4c1540478cdb2522b8194da041ce46c96261a318ed747dfd8ba0feddd87
SHA512b302793ffbed7c81746bc0c553d83cca5304ba5532a59045704363603d0acd3bc714b0f3154feef60f46fea0bd66225501078a0f1c7d7060e1db6161366c25fd
-
Filesize
472KB
-
Filesize
116KB
-
Filesize
116KB
-
Filesize
472KB
-
Filesize
116KB
-
Filesize
116KB
-
Filesize
472KB
-
Filesize
56KB
-
Filesize
116KB
-
Filesize
472KB