Analysis
-
max time kernel
119s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
25/12/2023, 10:30
General
-
Target
1753538870ccee2f5c12e6c37412e33f.exe
-
Size
115KB
-
MD5
1753538870ccee2f5c12e6c37412e33f
-
SHA1
eba5e3772892283a9822f32209a12597b699654a
-
SHA256
852457279a60f982fb82b7a1eb935ec52e139d6dafff78094eb9699cd83b41a0
-
SHA512
d77ae258b64a31d882f993531ef51a9bf26a75e26b00130ec1659b3f3337cdca1ac2b6ecd00ce0def5fea10e207a017a9c4c8a090b90307fd914e932273daa48
-
SSDEEP
3072:g+VqGiO+d1fCHlpHxJUx60i6zYeTktn5keLZos2nB1zd:tPiLdcHlBxJIU+YeIt5k5
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 4 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1753538870ccee2f5c12e6c37412e33f.exe"C:\Users\Admin\AppData\Local\Temp\1753538870ccee2f5c12e6c37412e33f.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1753538870ccee2f5c12e6c37412e33f.exeC:\Users\Admin\AppData\Local\Temp\1753538870ccee2f5c12e6c37412e33f.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
115KB
MD52fb59c46c052ea2f241464efb46bbf68
SHA1b2e35e3d61fef11c2c339bdbf4ef5f60daba1adf
SHA256579b1da6f1f965a9ee4fb972a154e6463fdd21d1ad0f3df3fee1f7c8970e9493
SHA5128491fe4046b5da732062efdaf0fc08787ab17f9f15169bff265bc3d1c82ad59279cf095bd78e61dac51c45a05e219c8c23074b348effdd9a65c3fb4757bb108d
-
Filesize
468KB
-
Filesize
116KB
-
Filesize
56KB
-
Filesize
116KB
-
Filesize
468KB
-
Filesize
468KB
-
Filesize
116KB
-
Filesize
116KB
-
Filesize
468KB
-
Filesize
116KB