Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
-
submitted
30/12/2023, 00:17
General
-
Target
0843b78c148d3cd45ca88997797c3283.exe
-
Size
92KB
-
MD5
0843b78c148d3cd45ca88997797c3283
-
SHA1
fd02541cff18a8bfff4d0531fd027b6a3d5a40d2
-
SHA256
b721345183310b1ba27df7cc670f28efc0857ed591678cdd014868683a02241d
-
SHA512
461f53bf4d5b6042b299bc8b247df2d72cc0446920b1213e0a18389027b52943c0ec3359499dcf0f3aecfcf83c3cfe5687cd44f2ab087d07e03883898dd6cee1
-
SSDEEP
1536:gBlmdnNEg7EC1UcmBdG5kyTkWYpfq0CmuJd4BXKikc6C:+mdNEg7n/EdAkdWsyBbd4M5C
Score
7/10
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 1 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0843b78c148d3cd45ca88997797c3283.exe"C:\Users\Admin\AppData\Local\Temp\0843b78c148d3cd45ca88997797c3283.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\0843b78c148d3cd45ca88997797c3283.exeC:\Users\Admin\AppData\Local\Temp\0843b78c148d3cd45ca88997797c3283.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
232KB
-
Filesize
56KB
-
Filesize
108KB
-
Filesize
232KB
-
Filesize
108KB
-
Filesize
108KB
-
Filesize
232KB
-
Filesize
108KB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
232KB