Analysis
-
max time kernel
6s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
04/01/2024, 09:36
General
-
Target
40829be5ede6e78fbe30ad0666417262.exe
-
Size
133KB
-
MD5
40829be5ede6e78fbe30ad0666417262
-
SHA1
7d54a41921d3d317ff10c8bea067dfb76b2e1edc
-
SHA256
169387fc112e9161103c5d86461ca6cefc51f4455372cc749844cfba3819ee11
-
SHA512
ca8771398593d43645258e203ee9ef61e72e4c2daba5467785206a167a657f6157120fdf6b94765708df1d266512165e7d16e38467c6debf3b5a9c246d6f9c6c
-
SSDEEP
3072:z5z9rOATEeQTB39BTB9OpUHh8EfVSNiWro0xX7ngt3B6BDB4+iQ:t9r3EeE3p22zuiWro0V7gt3gBD++iQ
Score
7/10
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\40829be5ede6e78fbe30ad0666417262.exe"C:\Users\Admin\AppData\Local\Temp\40829be5ede6e78fbe30ad0666417262.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\40829be5ede6e78fbe30ad0666417262.exeC:\Users\Admin\AppData\Local\Temp\40829be5ede6e78fbe30ad0666417262.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
536KB
-
Filesize
132KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
132KB
-
Filesize
124KB
-
Filesize
536KB
-
Filesize
124KB