Analysis
- max time kernel
117s - max time network
125s - platform
windows7_x64 - resource
win7-20231215-en - resource tags
- submitted
08/01/2024, 00:59
General
- Target 4a3ae4d8a68e42b0f85b3f2af9b2089f.exe
- Size 2.9MB
- Sample240108-bb663shdcp
- SHA256 a8171d1e65deb8e4a8f3dcf910435d59012603fd7df63b20430ca6072282e877
Malware Config
Signatures
- Deletes itself 1 IoCs
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 1 IoCs
- UPX packed file 4 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Suspicious behavior: RenamesItself 1 IoCs
- Suspicious use of UnmapMainImage 2 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\4a3ae4d8a68e42b0f85b3f2af9b2089f.exe"C:\Users\Admin\AppData\Local\Temp\4a3ae4d8a68e42b0f85b3f2af9b2089f.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\4a3ae4d8a68e42b0f85b3f2af9b2089f.exeC:\Users\Admin\AppData\Local\Temp\4a3ae4d8a68e42b0f85b3f2af9b2089f.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
4a3ae4d8a68e42b0f85b3f2af9b2089f.exe
4a3ae4d8a68e42b0f85b3f2af9b2089f.exe
memory/2360-16-0x0000000000400000-0x00000000008EF000-memory.dmp
memory/2360-18-0x0000000000130000-0x0000000000263000-memory.dmp
memory/2360-17-0x0000000000400000-0x000000000062A000-memory.dmp
memory/2360-23-0x0000000000400000-0x000000000061D000-memory.dmp
memory/2360-24-0x0000000003410000-0x000000000363A000-memory.dmp
memory/2360-32-0x0000000000400000-0x00000000008EF000-memory.dmp
memory/3056-1-0x0000000000400000-0x000000000062A000-memory.dmp
memory/3056-0-0x0000000000400000-0x00000000008EF000-memory.dmp
memory/3056-14-0x0000000000400000-0x000000000062A000-memory.dmp
memory/3056-2-0x00000000002B0000-0x00000000003E3000-memory.dmp
memory/3056-15-0x0000000003920000-0x0000000003E0F000-memory.dmp
memory/3056-31-0x0000000003920000-0x0000000003E0F000-memory.dmp