Analysis
-
max time kernel
120s -
max time network
129s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
30-12-2023 21:36
General
-
Target
1d33102706db27576db4377a030fb0ac.exe
-
Size
5.3MB
-
MD5
1d33102706db27576db4377a030fb0ac
-
SHA1
4b416cd604493e2231034d1c473e30ebda9e3dc2
-
SHA256
360642c9794d090e8dae974e671103949d0de7f5ca8b6bcdc636b9d6b58f029d
-
SHA512
97d21fcd45bc740a27fad46b328ffaa5aca6e27313419ed6ba3209c238870465d0a6fb4a00c76d2f3d12b0557a43d0aa12afe9a5c05270cfcbb8609ca7d4b917
-
SSDEEP
98304:Bek/gm2i07sFmshYATEs19y8iD8wDFX93shYATEs1:im27GmshHtgX5shH
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1d33102706db27576db4377a030fb0ac.exe"C:\Users\Admin\AppData\Local\Temp\1d33102706db27576db4377a030fb0ac.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1d33102706db27576db4377a030fb0ac.exeC:\Users\Admin\AppData\Local\Temp\1d33102706db27576db4377a030fb0ac.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.3MB
MD599d0f4f739654e14a50220394bfc7ce5
SHA13e5183fc520102d6d10d8c36a60bada901b3af06
SHA256a88ce740cfea97286863acae6f05c77ec8ec8052f97cd0eae8fdf9a691cba594
SHA5128fc91a9345f4742c3fcf020411babe9dab756f32cb489558d82a86274815772738062456e3fead4cc6b87a0120ee160062139144a86e472fd0f8817c235d00c0
-
Filesize
4.4MB
-
Filesize
1.9MB
-
Filesize
1.1MB
-
Filesize
4.4MB
-
Filesize
4.4MB
-
Filesize
1.9MB
-
Filesize
1.1MB
-
Filesize
4.4MB
-
Filesize
1.9MB
-
Filesize
4.4MB