Analysis
-
max time kernel
120s -
max time network
138s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
30-12-2023 01:59
General
-
Target
0aea7ef3eb6aeb00a645af78f184ea7b.exe
-
Size
56KB
-
MD5
0aea7ef3eb6aeb00a645af78f184ea7b
-
SHA1
ef7f6dec5876f7e6bcc5995e3d293283bd16d393
-
SHA256
8133f24dd3e4face5b10d0f9d6747ef7b3852a9dc7a4465afb7e855a1b92b259
-
SHA512
34e720694018bfd923deadba24fafc2540239432a5b3840b73ccb92762c5f751cb058bc290e383c2492b807e0967b17e1b05092c0eff6d704e61b016f2fece8f
-
SSDEEP
1536:9jO9pCKfS6T1iGaogy4GElsIXzF9erWcCA6r:Q9pCAiGVKGzIX5cL6
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0aea7ef3eb6aeb00a645af78f184ea7b.exe"C:\Users\Admin\AppData\Local\Temp\0aea7ef3eb6aeb00a645af78f184ea7b.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\0aea7ef3eb6aeb00a645af78f184ea7b.exeC:\Users\Admin\AppData\Local\Temp\0aea7ef3eb6aeb00a645af78f184ea7b.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
56KB
MD547a97ccd440a42dd89c1382247249a62
SHA1e675bfbf29dcafe5bbb43a8fbfc7d529ef5a265c
SHA256ca336c94761829c823a229ca6b448f9e2a51908ec6be6348cede6b4d070af418
SHA5124723939f790d8d3e28c5e4d9ae0c275db6d7778aa07cf9f6cf6e00a16463d881ae6f25a89f41c7618725ecfe8f670fd657dae94686c85fb9596a243ba3a7f299
-
Filesize
232KB
-
Filesize
56KB
-
Filesize
108KB
-
Filesize
108KB
-
Filesize
232KB
-
Filesize
108KB
-
Filesize
232KB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
108KB
-
Filesize
232KB