Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
-
submitted
07-01-2024 21:50
General
-
Target
49dc29b126d3ca34cf92b57547364a55.exe
-
Size
115KB
-
MD5
49dc29b126d3ca34cf92b57547364a55
-
SHA1
e87af745bbe21dd2d2d2fd6704ac3aa68fad445c
-
SHA256
b4b77c2194be11999c98009b40b7b3f280b6ea0667ed54ba2704698fef2aafe4
-
SHA512
0591cb50ea0a6145f1b124d900a29e0153b7d858b7573999310ad1346b7d8e55ced9f837b78b6565a17ab70d15f461a100b0d3f55d8bcda536e3eb3eddcf0746
-
SSDEEP
3072:Dwht8xpIjcNUWvnPU7pYnMXXnRUxKHPYd:0jMpIjCxv87ynMXXRhPYd
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\49dc29b126d3ca34cf92b57547364a55.exe"C:\Users\Admin\AppData\Local\Temp\49dc29b126d3ca34cf92b57547364a55.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\49dc29b126d3ca34cf92b57547364a55.exeC:\Users\Admin\AppData\Local\Temp\49dc29b126d3ca34cf92b57547364a55.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
115KB
MD51bbcf3100fb53abbdbc1ac8ebfa63573
SHA1525fd8ab4b785355a364b382197c4c0cb3a24068
SHA25648de7f5b2066ecb06a6829abd2b88a608812176c632dd75b73169e6b334c8b1b
SHA512c6defc0bd7b0a0eeca9e4d847acc496464d3fad4c5ab8ebdfb3ea2df4e0b443cb603e5b0ecd2746cecd9f3a3e2904bd79040694bfb8aa0d5e962bacf4344f38a
-
Filesize
116KB
-
Filesize
468KB
-
Filesize
56KB
-
Filesize
116KB
-
Filesize
468KB
-
Filesize
468KB
-
Filesize
116KB
-
Filesize
116KB
-
Filesize
116KB