Analysis
-
max time kernel
120s -
max time network
231s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
06/01/2024, 21:12
General
-
Target
47309788d158da4972ee39c47b92dcbc.exe
-
Size
1.3MB
-
MD5
47309788d158da4972ee39c47b92dcbc
-
SHA1
3384d5854fcdfee5bb78a39240c77e388a087bef
-
SHA256
eb3adad4bfd89d88c8887e2bcf8cc9edd8f83869639669e517e3523f579b8ab4
-
SHA512
5394f512031e211de99895fd4180036413252a5f9b24d3adb67614db55793d8827a56970311e38f65bd0374ad887b8b580c3dd1d946553a2c9c10b21a69ac1ec
-
SSDEEP
24576:c7js4WLGgbRIb5hHEEC6yO8wM50oxOcO73iL4aLJSFYaV4zDIvG:iMGgbRI/FWye/xOcO73iLbOV4n
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\47309788d158da4972ee39c47b92dcbc.exe"C:\Users\Admin\AppData\Local\Temp\47309788d158da4972ee39c47b92dcbc.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\47309788d158da4972ee39c47b92dcbc.exeC:\Users\Admin\AppData\Local\Temp\47309788d158da4972ee39c47b92dcbc.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.3MB
MD5bec7e7fe8eb2ca2da7b4185c542e0c46
SHA13a6f1c509c96a88f3682c92bc8e92cd9c945e62d
SHA2569c40bcae78181581b0cfe8bcc40d551d497809221ef3e4a66008a770f35ddcf6
SHA5124496553ec49971a0ee1ebe0afc0e30d742ab09af7faf93040da07bead1eceed1dbd9cfbe8b67e0a982e75006bea5ba5d399513ec16b3df8e1c4d06dc0b50eb98
-
Filesize
1.1MB
-
Filesize
1.9MB
-
Filesize
4.4MB
-
Filesize
4.4MB
-
Filesize
1.1MB
-
Filesize
1.9MB
-
Filesize
4.4MB
-
Filesize
4.4MB
-
Filesize
1.9MB