Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
31-12-2023 12:48
General
-
Target
36b3c1d4e0e3c2619570c0fc3780b87b.exe
-
Size
1.3MB
-
MD5
36b3c1d4e0e3c2619570c0fc3780b87b
-
SHA1
86355a9f6379f3f870b4ab0d88ab04d01104caff
-
SHA256
ac6fa4b996b0fe8a09ad87acce0505980b7fc1c0c1b436742cbaf95666e16a7d
-
SHA512
997c32d0b527acc727b3c5daa5e5ca507df2cf31140d9d555556f56adc688df0cd54103b23e8b2dbf8f684283da3fd4a6683ccaf23757723ad719fa1ff582613
-
SSDEEP
24576:DMVF5UIF84r2zHnEOOUDB9azvKQBF0nXuc0eOcGBVHvG:YLUbE2zcziJpOZV
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\36b3c1d4e0e3c2619570c0fc3780b87b.exe"C:\Users\Admin\AppData\Local\Temp\36b3c1d4e0e3c2619570c0fc3780b87b.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\36b3c1d4e0e3c2619570c0fc3780b87b.exeC:\Users\Admin\AppData\Local\Temp\36b3c1d4e0e3c2619570c0fc3780b87b.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.3MB
MD55fb6dc8754773be793cfab3afca00601
SHA1db4979ff4b3274fdc7f3a71f18a61731e1c1b1f2
SHA2564710dd8cae016d619e7c693cc97bc50c65e8517593e4ce67f0ba474110624132
SHA512ea813050b2ab086efd2da09615b1fc53645284b6c5d23a40b7f091a5e3825def0249e9c037b6e7f60bcd719b19b915839c0e34fe3f320afbefe307cff0f9ab9e
-
Filesize
4.4MB
-
Filesize
1.1MB
-
Filesize
1.9MB
-
Filesize
4.4MB
-
Filesize
4.4MB
-
Filesize
1.1MB
-
Filesize
1.9MB
-
Filesize
1.9MB