Analysis
-
max time kernel
118s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
07/01/2024, 01:06
General
-
Target
47a1f7ba419c739eef5c455892418ab5.exe
-
Size
133KB
-
MD5
47a1f7ba419c739eef5c455892418ab5
-
SHA1
c78ffa172e40c4863c2d979e705200dd56959da0
-
SHA256
e9ca208ce53718ff9345c4e4f64ed9d14005d9f9a3ef5dc9a1c9d68c6a714c83
-
SHA512
47a1655129b524a857ce3f2df59ca9bb3178bbc4eaab9224ba98492e6c7084718dc65ba58531573456fe4d17c03b31b082746c29501f322a893d57ba81953bc7
-
SSDEEP
3072:1F4/R2ZEZ37N3AjO08EPOrblQ2jfBa4wxg13D+9DjcZZRqhhh5fbQ:1gvd75Aq0HP6blV8VAz57yhh5TQ
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\47a1f7ba419c739eef5c455892418ab5.exe"C:\Users\Admin\AppData\Local\Temp\47a1f7ba419c739eef5c455892418ab5.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\47a1f7ba419c739eef5c455892418ab5.exeC:\Users\Admin\AppData\Local\Temp\47a1f7ba419c739eef5c455892418ab5.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
133KB
MD5b9ae3808f649ad14640715870e7bd851
SHA1147195ffd7927d031dc0dc12391d3103511343a1
SHA2569f095b6ed467a1feaa87e6711a892b335ac38904b6bbddd928c631aaba46f9c4
SHA51247729fc9560fc5cb730365d321d40429698a66d8d439369557b77db2e1cacaea5e296953b2eb7fe77ab7326f33a2e30ed3d4bc49986cc9617488920a33511db7
-
Filesize
536KB
-
Filesize
132KB
-
Filesize
124KB
-
Filesize
124KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
132KB
-
Filesize
536KB