Analysis
-
max time kernel
119s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
30-12-2023 22:31
General
-
Target
1e87bfde7636ae49d9bba1111da512e2.exe
-
Size
2.9MB
-
MD5
1e87bfde7636ae49d9bba1111da512e2
-
SHA1
30d16e57c67d19bdefb7eca8ef2bd3074bb89b17
-
SHA256
2983709273ad0c20a0c34e65f6a6eb3837d47b351e081897e3535b497ee1483d
-
SHA512
0e404581325a7b9de0d919205bcd007cfdaa23d9a250816691cd6d130e240e75db93e036c166ba07479954703058394bca2b00f898fdb23bf4666f63777f805e
-
SSDEEP
49152:SPLeMUQuJ6/lXuPKmK8Am4X+yd/XGg83KPNA6UxMzhbF2dXvantheBpAlGN:SPLJ/gPKR39dvGse+zJIiHeBpAlW
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 4 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1e87bfde7636ae49d9bba1111da512e2.exe"C:\Users\Admin\AppData\Local\Temp\1e87bfde7636ae49d9bba1111da512e2.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1e87bfde7636ae49d9bba1111da512e2.exeC:\Users\Admin\AppData\Local\Temp\1e87bfde7636ae49d9bba1111da512e2.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
16KB
MD5ccf2611c397577b362527863b4f8d7a1
SHA195a8b7418dab681f4860b78405c50609628d0dd0
SHA256baa6f9796ef577a25d84535f1f019cc585d6f006deef8d73ab97d1a52ef0bf64
SHA512873e66e13bee76ca463414533b63df4a1b588f32f3cabbe84ebfeb70e1e980e77fb5ec392260e8ee9bcac5641929c42689a00d32a5d3580079c351e64332a346
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
2.1MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
4.9MB