Analysis
- max time kernel
120s - max time network
122s - platform
windows7_x64 - resource
win7-20231129-en - resource tags
- submitted
31/12/2023, 02:01
General
- Target 23b9ca18739fd576578d05cd6338cfb2.exe
- Size 1.3MB
- Sample231231-cfvjhsbbbp
- SHA256 ce215006ea43784164584f216df94ebff9a759479d0df87e3e6c7d4cb5a66b3d
Score
7/10
Malware Config
Signatures
- Deletes itself 1 IoCs
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 1 IoCs
- UPX packed file 4 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Suspicious behavior: RenamesItself 1 IoCs
- Suspicious use of UnmapMainImage 2 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\23b9ca18739fd576578d05cd6338cfb2.exe"C:\Users\Admin\AppData\Local\Temp\23b9ca18739fd576578d05cd6338cfb2.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\23b9ca18739fd576578d05cd6338cfb2.exeC:\Users\Admin\AppData\Local\Temp\23b9ca18739fd576578d05cd6338cfb2.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
23b9ca18739fd576578d05cd6338cfb2.exe
23b9ca18739fd576578d05cd6338cfb2.exe
memory/1364-0-0x0000000000400000-0x000000000086A000-memory.dmp
memory/1364-1-0x0000000000400000-0x00000000005F2000-memory.dmp
memory/1364-2-0x0000000000250000-0x0000000000362000-memory.dmp
memory/1364-15-0x0000000000400000-0x00000000005F2000-memory.dmp
memory/2928-19-0x0000000000130000-0x0000000000242000-memory.dmp
memory/2928-17-0x0000000000400000-0x000000000086A000-memory.dmp
memory/2928-16-0x0000000000400000-0x00000000005F2000-memory.dmp
memory/2928-25-0x0000000000400000-0x000000000086A000-memory.dmp