Analysis
-
max time kernel
118s -
max time network
142s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
30/12/2023, 10:09
General
-
Target
156be478e941d9108e031181ee0bf72a.exe
-
Size
82KB
-
MD5
156be478e941d9108e031181ee0bf72a
-
SHA1
aeb2e689fbdc18283b74a39c9288c1e7c8f82788
-
SHA256
fa60642b7f2d5c443d7598b7ce9bb4bae9f6143b919f28b0e402ec890784653d
-
SHA512
a9528309f1b17558cbf4a53a87ab823f12f106a90a92142fd4eed84b32f8257a3f8e0bf6cfde943cc93a0d5521922909d7651dbbc9ee5761a937c5b110a8b45a
-
SSDEEP
1536:YSfnrWgK7Jk9LqJqBDfdLw/Dwp+Zv/heCiV9IUgYZaWve9YGCs7Fb6KOfj+Qsizc:YSfnrFmJk9vDfdSPhnijFgN4sJ6FjG
Score
7/10
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\156be478e941d9108e031181ee0bf72a.exe"C:\Users\Admin\AppData\Local\Temp\156be478e941d9108e031181ee0bf72a.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\156be478e941d9108e031181ee0bf72a.exeC:\Users\Admin\AppData\Local\Temp\156be478e941d9108e031181ee0bf72a.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
82KB
MD58f00ab99fa09e9090bee6c9078ddc1c3
SHA1fa44579706118f97a033f089875ae85bc8b755c1
SHA256ae730dbbbd85e927bf23799ce9198b395a1226b5fe5cf8552a3dbbfac7d35003
SHA512d474d3301fd201ca7d4a036a2ac357ddd7ab2398d8377d0d902f759c0668c1b4c16195a47b35f89507dcd06bc6848953c2bbf8f214718d8722bbe1fce08e55b6
-
Filesize
188KB
-
Filesize
108KB
-
Filesize
56KB
-
Filesize
188KB
-
Filesize
108KB
-
Filesize
188KB
-
Filesize
188KB
-
Filesize
108KB