Analysis
-
max time kernel
119s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
-
submitted
10/01/2024, 02:22
General
-
Target
4c859588cb2daf6b5a199a1633c40d3b.exe
-
Size
59KB
-
MD5
4c859588cb2daf6b5a199a1633c40d3b
-
SHA1
0d42e57caf5cbbc65560eb9a451b86ac4fb1f297
-
SHA256
2ce9a90e60dd3bb1f34d3aca94091d6ff24573979fc9e24562b2801e2355c220
-
SHA512
e3de6ff238c034e83e7a371f5f99d7240d6d0132bf8662e7114a8dae66f4b998732764ce37d5a866d07d211b4d9be07ae15ae05376c6d0cc7a426ff6a232ff35
-
SSDEEP
1536:VMrautTvD2wKmd8IRRlfYrfm+gdqBU1tT9DJXISE08Q:VM1dbZdjRI7HlqISERQ
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\4c859588cb2daf6b5a199a1633c40d3b.exe"C:\Users\Admin\AppData\Local\Temp\4c859588cb2daf6b5a199a1633c40d3b.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\4c859588cb2daf6b5a199a1633c40d3b.exeC:\Users\Admin\AppData\Local\Temp\4c859588cb2daf6b5a199a1633c40d3b.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
59KB
MD52e0a9184610c8ee276396b240d98a9fe
SHA1333518bb43e4f7cf78a21597ca6092269cd5f72d
SHA2561372cc98504c3279a9ee8e305809468502d59231f7a73ac8d0bc19d957dc00e8
SHA512d6cc8a7b0e494ee67c2c72da570a4aaad894c488c07edbace66c8eb5fb3f30b30159d3176910d8fe474bd37f089987f821da26c2cca03c749b6c588cb27c76be
-
Filesize
244KB
-
Filesize
116KB
-
Filesize
60KB
-
Filesize
116KB
-
Filesize
244KB
-
Filesize
116KB
-
Filesize
244KB
-
Filesize
116KB
-
Filesize
56KB
-
Filesize
60KB
-
Filesize
244KB