Analysis
-
max time kernel
119s -
max time network
137s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
28/12/2023, 21:45
General
-
Target
fa4c54e03f87e8edfebe6c2534082a1e.exe
-
Size
353KB
-
MD5
fa4c54e03f87e8edfebe6c2534082a1e
-
SHA1
4a159a051f1d1e0a1dc253d91f55792dec657ed6
-
SHA256
d49c25c92ce259ac426aaab41bbb638eb9bc200f03896e9e806639f3247a3966
-
SHA512
a0eaa278bd82b9d16e7e6e5d168af6e0e6dfef963416da565d5dfd25c24503e2704176531f924f0bf1893289dd2f652c4c3537f7bc9c06fb373e0cd65e544f4c
-
SSDEEP
6144:5CmaWzbm/YaFQz9SOeC1ySkGmN1zkICcj6c9KKgQDYdxfsLPrPwo+:ZLMESOeTSkGmN1zpCcGc9HTYTfmE
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 4 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\fa4c54e03f87e8edfebe6c2534082a1e.exe"C:\Users\Admin\AppData\Local\Temp\fa4c54e03f87e8edfebe6c2534082a1e.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\fa4c54e03f87e8edfebe6c2534082a1e.exeC:\Users\Admin\AppData\Local\Temp\fa4c54e03f87e8edfebe6c2534082a1e.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
353KB
MD56d294e39389d56522d38ce7271691587
SHA19aa64651b0b8aab6c448391d709888a369532cd3
SHA256b7700811293e58a262ef08d100fbfd79434a7e81db85522580afdc0e447a9117
SHA512deacbc176da72e4aed86e7f43070d1e4caab27a49a74da5b00d2540120943e8418f6b27c45f4246207a726e5b12fb2f2227f8fe9a63237e1c4afa6be7bd9e3e9
-
Filesize
964KB
-
Filesize
204KB
-
Filesize
320KB
-
Filesize
964KB
-
Filesize
320KB
-
Filesize
964KB
-
Filesize
264KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
204KB
-
Filesize
964KB