Analysis
-
max time kernel
122s -
max time network
233s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
30-12-2023 13:01
General
-
Target
1950f4e0d321a05106c9904f453a4882.exe
-
Size
1.3MB
-
MD5
1950f4e0d321a05106c9904f453a4882
-
SHA1
fbea864551b6b49a1976e5bf8e56c3c4fe1070d9
-
SHA256
90ac8c5f028b7c4a155723fef15f6ebded70771f42296cd6b2fe6cfde04dac05
-
SHA512
5b96cbf723f74133f10f10daa1fcfd7658c1e8906d275d6775672f7dd4f3e8298a9c69b3ee48e7137d92222d8c7b5a95574efa003ff8152b7a56e06eae3e6187
-
SSDEEP
24576:nNqp4Un7wdqjWHbYMM255QIvsJ7kGXu1vOHF6sY5en1vG:076bzVQtJ7ruwUsY5e
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 4 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1950f4e0d321a05106c9904f453a4882.exe"C:\Users\Admin\AppData\Local\Temp\1950f4e0d321a05106c9904f453a4882.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1950f4e0d321a05106c9904f453a4882.exeC:\Users\Admin\AppData\Local\Temp\1950f4e0d321a05106c9904f453a4882.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.3MB
MD508d5d9c59cbeb5f444911ddf9950d5b0
SHA14a50873c3ff72c19a53eca8745c43ae9bd007ef9
SHA256e4fb93a0010ec916f1179159501764e160c641df78f8196a6a8efe24f941979f
SHA5128d1d4f3ea43dcc1386e4bb898612c901d7d6106791f5222cf3769f3e76efa14ef720725256284787b341fa0ae047d9142f6bf6ddeaa47a7559909aaf391cdf17
-
Filesize
1.9MB
-
Filesize
1.1MB
-
Filesize
4.4MB
-
Filesize
4.4MB
-
Filesize
4.4MB
-
Filesize
1.1MB
-
Filesize
1.9MB
-
Filesize
4.4MB
-
Filesize
1.9MB