Analysis
-
max time kernel
2s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
05-01-2024 07:55
General
-
Target
4329c83b21ee8d3e6a11b1616e64bad1.exe
-
Size
266KB
-
MD5
4329c83b21ee8d3e6a11b1616e64bad1
-
SHA1
16f7b83dc6596e7dbd9bd0b675ad0a4f0b17cc19
-
SHA256
e4f00de202afd459d687aa592b577f4bee76c3b8bf71db83d671ef486c6abaf4
-
SHA512
3c8535a84cf1c1d82f1dfa9cd92a9a4f51bfafd2d09daacb3d26921d11c6a6f6dbae30c19b9327c04b096e050a106f066a9333f7eaae316a8199d2c6576945a3
-
SSDEEP
6144:6yZrQ1bejlejEiLKaWeL+/xxmATUkVehjvHFK2j/B3eGJdDkHvt0N3govQ:68Q1beavL3PL+53OLHFTuGbkP8o
Score
7/10
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\4329c83b21ee8d3e6a11b1616e64bad1.exe"C:\Users\Admin\AppData\Local\Temp\4329c83b21ee8d3e6a11b1616e64bad1.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\4329c83b21ee8d3e6a11b1616e64bad1.exeC:\Users\Admin\AppData\Local\Temp\4329c83b21ee8d3e6a11b1616e64bad1.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
536KB
-
Filesize
132KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
124KB
-
Filesize
536KB
-
Filesize
124KB
-
Filesize
132KB
-
Filesize
536KB