Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
08-01-2024 12:23
General
-
Target
4b6d6b6c98fe55b514b042fc1b2d1387.exe
-
Size
59KB
-
MD5
4b6d6b6c98fe55b514b042fc1b2d1387
-
SHA1
d5d67bedf986f74e54c7b3b1a8ac1c7f3cb1c1eb
-
SHA256
7a841d0451ac82cc5afcac7ee1c39bab46a5357c62017ee469b7cfc0f7a75a14
-
SHA512
47eea89edd886b978afd749dabe49f99ddd0329606740b1198dfc22de85459fa89a49f8a5ff23c9989163ff2fdc7a0991b0023dcf5a011d2c370cd31a11b96ab
-
SSDEEP
1536:NkPhWe6To4xXQrCrxT/k8N3ZnJcf5s8iZv86zC:NkP83TDgrCrt/kypnqKJj
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\4b6d6b6c98fe55b514b042fc1b2d1387.exe"C:\Users\Admin\AppData\Local\Temp\4b6d6b6c98fe55b514b042fc1b2d1387.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\4b6d6b6c98fe55b514b042fc1b2d1387.exeC:\Users\Admin\AppData\Local\Temp\4b6d6b6c98fe55b514b042fc1b2d1387.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
59KB
MD56f5982c5c0c682cb1ffdb7856466d515
SHA1c308641cf65104d4aa3d5f2d8dc96cddf473ddfd
SHA25649d65f870ee2fafaf15c2704e80d37be6f1d66f783b78561d911c554e4feeb89
SHA512acc7ca6211e37024621d39884dc0a13b7e58011b20abd63d14685758d9b9d449f56092e920f165eca1b831170c19d33751f4838a3c4543eb1e908e1bc915efce
-
Filesize
116KB
-
Filesize
244KB
-
Filesize
60KB
-
Filesize
56KB
-
Filesize
116KB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
116KB
-
Filesize
60KB
-
Filesize
244KB
-
Filesize
116KB