Analysis
-
max time kernel
122s -
max time network
130s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
31/12/2023, 04:12
General
-
Target
27a81213d1580cc5ae99eaa62a6fbc8a.exe
-
Size
2.9MB
-
MD5
27a81213d1580cc5ae99eaa62a6fbc8a
-
SHA1
c2d542f5a1f7a35f69913c6f589bb22935b91b28
-
SHA256
792aae4352d73717bf51021665b3727571fd3989734e295611e2cbe11ade668c
-
SHA512
b83193e3cee241310369f8a0af7552f77d6f67d8e2d71286fb7913eede717f1304a23751fd96d1d710b6d60da3e962cdb8b6518aa32b30e7b29c23f71f943c7d
-
SSDEEP
49152:IDqo+hxhVW0L6F8nDpN74NH5HUyNRcUsCVOzetdZJ:Ij+h7U0L62Dp4HBUCczzM3
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\27a81213d1580cc5ae99eaa62a6fbc8a.exe"C:\Users\Admin\AppData\Local\Temp\27a81213d1580cc5ae99eaa62a6fbc8a.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\27a81213d1580cc5ae99eaa62a6fbc8a.exeC:\Users\Admin\AppData\Local\Temp\27a81213d1580cc5ae99eaa62a6fbc8a.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.9MB
MD5ae4369fab04635ef1e19ef7e6da98ec5
SHA1b5ffa378f34abe4e77fc243b2c489f80a7df37b9
SHA256ad31c625724a2757483d6a4f283e1cde46eb19acfda2da646fb450b0fbd79700
SHA512a5d2ce0c06e5b8eb726c788ac48ff700f63c729d6d5a180b31180ab5b52660706fc5661387c625bbd51c57f8f1fed4da1dc1107711fdf59f557d83b886292a61
-
Filesize
2.2MB
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
4.9MB
-
Filesize
2.2MB
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
2.1MB
-
Filesize
2.2MB
-
Filesize
4.9MB