Analysis
-
max time kernel
117s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
-
submitted
06-01-2024 01:44
General
-
Target
44f6e7fbe5f3da47a8a3d7fa9a53f724.exe
-
Size
133KB
-
MD5
44f6e7fbe5f3da47a8a3d7fa9a53f724
-
SHA1
701abd3fd1707ec21931fa5dd1dfff0f09c47152
-
SHA256
80c098b65a7600639de89c8b92362e2d60fe3aa9c546ec6c48102474f9023488
-
SHA512
83a0793646e63348d5dac8e94a9be828e3515509cf603398f3f4c2549ec3018032243b1c896e8231de10f8d087a5acc1a4c868cdc487210aa5404fbe8309e98f
-
SSDEEP
3072:BdvuZkbyTF0VFRPI4wz4bHSsezQiUdIn/Z62F1qhv/Q:BkA+8FgzcEzfUs6HJ/Q
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\44f6e7fbe5f3da47a8a3d7fa9a53f724.exeC:\Users\Admin\AppData\Local\Temp\44f6e7fbe5f3da47a8a3d7fa9a53f724.exe1⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
C:\Users\Admin\AppData\Local\Temp\44f6e7fbe5f3da47a8a3d7fa9a53f724.exe"C:\Users\Admin\AppData\Local\Temp\44f6e7fbe5f3da47a8a3d7fa9a53f724.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
133KB
MD57fca06f8d57dab30b22338d335ba1b1c
SHA1c3a601f94e76c83a94618aa84c134f861469752d
SHA256be8d6c98e1d0169dfd45b9f840ccd8f52f0762f0040186b5c2fd27f19748eb04
SHA512a0801e67360225c1fd0cf5de15c81f7594221f880ce11494fe829f3b4104845f20e3e6533f043fb8cd1dc778b9ecf471cd530aaa309a0c09a4b82584059a99f1
-
Filesize
536KB
-
Filesize
124KB
-
Filesize
124KB
-
Filesize
132KB
-
Filesize
132KB
-
Filesize
536KB
-
Filesize
536KB