Analysis
-
max time kernel
119s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
31/12/2023, 05:21
General
-
Target
29cff265e40128c6b36f96fe29f8f80f.exe
-
Size
80KB
-
MD5
29cff265e40128c6b36f96fe29f8f80f
-
SHA1
36cbf6f7e43e61d3e8e4f1105ab718948bdee76f
-
SHA256
be1cf64c0ca17c00bfcc5def32002f71deff61acddc67def356f0636e890c551
-
SHA512
b7093d8a42d2622f07d6f893defdfeaeb02ae518085217184ed611fb69c54f2ff4b0d7c1d300111c6440d4b6ffd39f7adc00fe570382e136ca5496800f3eb314
-
SSDEEP
1536:anIiexo/2Xsi8hzuKxY/KJfJa25MiK0rmS0L7aW0CmuJd4BXL:anOxo/fimBIKRJa25MiL2VBbd45
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\29cff265e40128c6b36f96fe29f8f80f.exe"C:\Users\Admin\AppData\Local\Temp\29cff265e40128c6b36f96fe29f8f80f.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\29cff265e40128c6b36f96fe29f8f80f.exeC:\Users\Admin\AppData\Local\Temp\29cff265e40128c6b36f96fe29f8f80f.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
80KB
MD5f1dddf72cd2ce08a03768b8224a11610
SHA1e44eb49e49adf15a5a4bf9c45274577e69eefdcb
SHA256584fb97c1ee465363b4912ded2f89823ec1d80f0df523a132c148f8dd6fc206d
SHA512d4ff11dfd8929f899d632fd4149ccebc55f4630d78c83ecdf559d41177196d96e379625dae16eb5e98f96532de922f697f403f9f4b85b07cdbfdb5d116fefed6
-
Filesize
232KB
-
Filesize
108KB
-
Filesize
56KB
-
Filesize
232KB
-
Filesize
108KB
-
Filesize
56KB
-
Filesize
108KB
-
Filesize
56KB
-
Filesize
108KB
-
Filesize
232KB