Analysis
-
max time kernel
121s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
-
submitted
30-12-2023 02:34
General
-
Target
0bcfc8363b17d7550c405ca130a4f406.exe
-
Size
115KB
-
MD5
0bcfc8363b17d7550c405ca130a4f406
-
SHA1
a96bb63d4a6e23bc110e54f0322d5f71f4339763
-
SHA256
60b053573d2913128afcf486f93975d615322afd0090e9dfc30ea7a945fcbe05
-
SHA512
784d079dcdecee8bfcd5514b85b18e122d01ba17294d002b17d9d77fd5fafdc16ea71f03c7a1124290b39ef390d376e17ba2f2efc4611ff94b0ed6c27c6786d8
-
SSDEEP
3072:sxe3OXU/YBI0ivxFNjM0eL2LOPQAXraD:2U8IVvxFNjTOm
Score
7/10
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0bcfc8363b17d7550c405ca130a4f406.exe"C:\Users\Admin\AppData\Local\Temp\0bcfc8363b17d7550c405ca130a4f406.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\0bcfc8363b17d7550c405ca130a4f406.exeC:\Users\Admin\AppData\Local\Temp\0bcfc8363b17d7550c405ca130a4f406.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
468KB
-
Filesize
116KB
-
Filesize
116KB
-
Filesize
116KB
-
Filesize
468KB
-
Filesize
116KB
-
Filesize
56KB
-
Filesize
116KB
-
Filesize
468KB
-
Filesize
468KB