Analysis
-
max time kernel
117s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
26/12/2023, 15:36
General
-
Target
795f94d1c089c14fd204f41cce5d0a62.exe
-
Size
1010KB
-
MD5
795f94d1c089c14fd204f41cce5d0a62
-
SHA1
2646a7b680a5eb05decf6e5e0655a7b7d0b11c10
-
SHA256
c3fdbdf0ba5013d60d9d7de5ec5fb39e6eaa4265d364c34f3d0e462a9abf37b3
-
SHA512
cc8e10c9b135232fcd0dd0688390e2f44bbb5d72926d6843958a634940129e97343992c21ec63fcf4caa020984f19a3b112c003e9fd0762f5170aae97a2bbdf5
-
SSDEEP
12288:1mBNbj9y3awsnqYTfm6hiYc5plDFwrilMiYTfm:1gbhy3a9nqmfduvlB7lbmf
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 4 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\795f94d1c089c14fd204f41cce5d0a62.exe"C:\Users\Admin\AppData\Local\Temp\795f94d1c089c14fd204f41cce5d0a62.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\795f94d1c089c14fd204f41cce5d0a62.exeC:\Users\Admin\AppData\Local\Temp\795f94d1c089c14fd204f41cce5d0a62.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1010KB
MD541f0933ad13f3f630520dd0ce03e4c4b
SHA19273621295a82191ab79ac6f17baf6130c687e70
SHA256f33aab3eca36518b9c44be179ad15e36b9d2ca73157513c8fd61881ac8d91adc
SHA5120ca33ee239ea1877adb810f6d5dafa8aa482fc795c49ca575243b81a4c01f64b992c93b1efe3f5a2deb339648809b501aa1bdadc121b702b0736e68e07bbdf6c
-
Filesize
964KB
-
Filesize
204KB
-
Filesize
320KB
-
Filesize
964KB
-
Filesize
320KB
-
Filesize
964KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
264KB
-
Filesize
204KB
-
Filesize
964KB