Analysis
-
max time kernel
118s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
31/12/2023, 06:08
General
-
Target
2b36b25fe1bb3a0481fede9a95429b66.exe
-
Size
1.3MB
-
MD5
2b36b25fe1bb3a0481fede9a95429b66
-
SHA1
d2f32fe1244833369a1a90571a2e88c8305fdac2
-
SHA256
aa8e601691ed2006b45032c9ba3203fefead7a94ff6a88be813f4cceaa4f1a13
-
SHA512
cab1493b6f3ce6e4a9a2e5fc30f5778d8a0e861a7932c9588db2ef4ab9ba105c1e63657050caeb90cfb655321e077c05c19e04f0a68e28da1663bafab88e7370
-
SSDEEP
24576:iLwZsAgxbJCxevMWRKqK/kpO2uIYtbo0b/jHeJLkku5kHCr/63jqnR89U/AU9/9j:YUbgxr5RHcT2uIYtbo0K2yw6TSR9R9j
Score
7/10
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 4 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2b36b25fe1bb3a0481fede9a95429b66.exe"C:\Users\Admin\AppData\Local\Temp\2b36b25fe1bb3a0481fede9a95429b66.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2b36b25fe1bb3a0481fede9a95429b66.exeC:\Users\Admin\AppData\Local\Temp\2b36b25fe1bb3a0481fede9a95429b66.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
-
Filesize
4.9MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
1.2MB
-
Filesize
4.9MB
-
Filesize
2.1MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
1.4MB
-
Filesize
2.1MB
-
Filesize
1.2MB