Analysis
-
max time kernel
113s -
max time network
259s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
01/01/2024, 04:23
General
-
Target
3be1f8e587324d4d01f7cdea89101716.exe
-
Size
1.3MB
-
MD5
3be1f8e587324d4d01f7cdea89101716
-
SHA1
99aa2a6e50eb2d2c9586c7e47f5d5abd66d339e4
-
SHA256
653e6ba323fc695ff9a7dc5801904657d54a892352239bee049916917bd599c8
-
SHA512
63e2c0d288b569eced4739fb37f638f0ed3d72352b43d3b038848a9705216e173d8378f6eff8718a086da7892a99b8d6680fd58d0a401d862b055d65201069bb
-
SSDEEP
24576:XJS8IVsT+X72W19Urdok/Uw+0OCvL0SuoChCv823USnB/P/tgxh1d3vPmIN91aAC:XJSyTSKdF/Uw+0lT0kC85USBX/qxh1dC
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\3be1f8e587324d4d01f7cdea89101716.exe"C:\Users\Admin\AppData\Local\Temp\3be1f8e587324d4d01f7cdea89101716.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3be1f8e587324d4d01f7cdea89101716.exeC:\Users\Admin\AppData\Local\Temp\3be1f8e587324d4d01f7cdea89101716.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.3MB
MD5f8ba14239c43834a5b1899c5acd8af64
SHA176c442c231e86fc458d63ee55c8aa7d64306f77a
SHA2560397334287c38e1fd6dc3a2d63e0b58deaed3e09a25f9889b812505fad7d3476
SHA5120a563d3ef617b3974764ad82a0cdde25d70cd6962f82eabed7e65c67d476ae1ff4ab9e68e8a3f3e678d5e4025750813c5fa7a98ff7609eb1877d3eb87bc58fd4
-
Filesize
2.2MB
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
4.9MB
-
Filesize
2.2MB
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
2.1MB
-
Filesize
2.2MB
-
Filesize
4.9MB