Analysis
-
max time kernel
118s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
-
submitted
30-12-2023 04:50
General
-
Target
0f0ff38cb163632603dd1e15514a5610.exe
-
Size
1.5MB
-
MD5
0f0ff38cb163632603dd1e15514a5610
-
SHA1
23652411a11f366f62f1cb229b7b05ee9383c724
-
SHA256
0a62db95264abf035e276a3cf3cf30969456543c39caf43367bb79c8045f45fa
-
SHA512
f589a772683683e948bf29f88262ca4f33ca8379eca5b647ee2171582c81d8504475ba2fe92ad14356fc0b16397cc44a5b3e7e2d5293c36d767275cdf236e39c
-
SSDEEP
24576:eNnxuTG7ei8wOlna3Jt3zV0vErfc+j/C8+K7l5/TbRYhE7W:+xuTGyqO8zSvifcIDv55H
Score
7/10
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0f0ff38cb163632603dd1e15514a5610.exe"C:\Users\Admin\AppData\Local\Temp\0f0ff38cb163632603dd1e15514a5610.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\0f0ff38cb163632603dd1e15514a5610.exeC:\Users\Admin\AppData\Local\Temp\0f0ff38cb163632603dd1e15514a5610.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
4.9MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
2.1MB
-
Filesize
4.9MB
-
Filesize
2.2MB
-
Filesize
4.9MB