Analysis
-
max time kernel
126s -
max time network
275s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
10/01/2024, 13:00
General
-
Target
509f3270f290efb02fbfbaf80c94be2c.exe
-
Size
1.5MB
-
MD5
509f3270f290efb02fbfbaf80c94be2c
-
SHA1
f7ea28e812f2438d9cb71af388de1e30841e5d06
-
SHA256
27035770b0d5e09e47ea323d3ca656481fa4b56891bd701d2c4a35b379e67191
-
SHA512
ccacf033962176cecfc67ef80fde5d0ef597390ba24121d34458169ba667cbd0bbfd8b302ee180d249c6c4a7ea8cfe8f18a2e2b089afea8c50950a0127f05dab
-
SSDEEP
24576:i35JYJiz5yRYZoknwpV6VHCqRgNXuoXU7nqaUEl0MZEDwJWQmwFScjuU1vHoFGcj:6YJO5mIovn+HzCtjaZU3MZowJTmwFjjJ
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\509f3270f290efb02fbfbaf80c94be2c.exe"C:\Users\Admin\AppData\Local\Temp\509f3270f290efb02fbfbaf80c94be2c.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\509f3270f290efb02fbfbaf80c94be2c.exeC:\Users\Admin\AppData\Local\Temp\509f3270f290efb02fbfbaf80c94be2c.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.5MB
MD5f45c496cb6c03179a5526faedaf83b6d
SHA1fd5782248945eb2cfe1b0e2d3878aad0c7aba5a2
SHA256d482d007846c641eb237718ca32dbc7b89ec170099e9768c275f20f2148728f4
SHA51225f616d2f21f9711ed6f1dda4753f63f3ba2cf516666d0187e85a8a264462b15742d44a507b33bbadb52380f5b32417c628bde1843d8f39c44fd924985674ee5
-
Filesize
2.2MB
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
4.9MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
1.2MB
-
Filesize
4.9MB
-
Filesize
2.1MB
-
Filesize
2.2MB
-
Filesize
4.9MB