Analysis
-
max time kernel
122s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
04/01/2024, 03:38
General
-
Target
3fcccb13d1f757adac7cfaa67e103b53.exe
-
Size
56KB
-
MD5
3fcccb13d1f757adac7cfaa67e103b53
-
SHA1
1c468cd7500d393fcd4321a35ad868abf95a6087
-
SHA256
71cddade3c2ebf71487953513d284b53a44c899459af4cc5523955cf06f7917f
-
SHA512
1e5fd2bc1bfe2e16213215d949fa00ad4d36ee9e418b713e685483fe322b0fe18a916fa1aeaa9d5450458fba64ce0d6683b3c1113dc892250767fea6aae872ce
-
SSDEEP
1536:TylGYT9p0ni9FYSuLXzAUEKtgdyWhQaJiyLS+5uE:TylpTLTFYfEKG1+avLo
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 4 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\3fcccb13d1f757adac7cfaa67e103b53.exe"C:\Users\Admin\AppData\Local\Temp\3fcccb13d1f757adac7cfaa67e103b53.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3fcccb13d1f757adac7cfaa67e103b53.exeC:\Users\Admin\AppData\Local\Temp\3fcccb13d1f757adac7cfaa67e103b53.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
56KB
MD5fae69c316dd358078ba868f30f518a16
SHA189dd19c290ce020363d5daf690ba24efbfc32197
SHA25695f9f48a6c4aa75ff67d04ad9938be327ae87a55a635aa0e3c393d56bc6f2c4e
SHA512ba91f82465062b8c1049a88e6b17929f8a90f517118300e175792dcc7c76a245f1e0e7b01adf61d471e4430a43f1a890863eb336ed8e04aac36f06784135ffc0
-
Filesize
232KB
-
Filesize
108KB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
108KB
-
Filesize
232KB
-
Filesize
232KB
-
Filesize
108KB
-
Filesize
56KB
-
Filesize
232KB
-
Filesize
108KB