Analysis
-
max time kernel
117s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
24/12/2023, 19:43
General
-
Target
0e7335b507e6aadd84b731e80fd5032d.exe
-
Size
59KB
-
MD5
0e7335b507e6aadd84b731e80fd5032d
-
SHA1
2bdf3fcf3c0eb09d6138bffb933a36750506235f
-
SHA256
238e758258300d929821a454ad4e623f36962d81935fd6b70218287f8278d8fb
-
SHA512
5ea24e1f5c9b0f5a42219b0dab696a7038de96dcca05a5a55d5a9b4a7bac4ec7a00134b063a5654a25a9121983009023a132d852b05494d78ac0e26386090a82
-
SSDEEP
1536:ARxT7IHmdKSzK0YCEakFglku3MXDPOh3RssjA7QQ/uso6J2Yd:APcHXSzKy5OXOKsUusoEN
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0e7335b507e6aadd84b731e80fd5032d.exe"C:\Users\Admin\AppData\Local\Temp\0e7335b507e6aadd84b731e80fd5032d.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\0e7335b507e6aadd84b731e80fd5032d.exeC:\Users\Admin\AppData\Local\Temp\0e7335b507e6aadd84b731e80fd5032d.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
59KB
MD533c1494134ae02208bf0f3f8045f27d9
SHA1c6aa82d65fc5ae04310df85b833224ea7e5d9f20
SHA256f8364b077dd61dd872e787e02ebd6ea71f1c3550bc01afd31aa7133f89553f0e
SHA512e33d7c22d54038e66da4f52eee8058af2736d7304b5a3e2dfdae8074bc7e03d012c82185480e987b2761e54eeb1d423051465b2bbffb9b5bad471df066fc738d
-
Filesize
244KB
-
Filesize
116KB
-
Filesize
116KB
-
Filesize
60KB
-
Filesize
116KB
-
Filesize
60KB
-
Filesize
116KB
-
Filesize
56KB
-
Filesize
244KB
-
Filesize
244KB