Analysis
-
max time kernel
13s -
max time network
140s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
-
submitted
11/01/2024, 21:24
General
-
Target
549e59d353d483b01c5f197d482aa19b.exe
-
Size
133KB
-
MD5
549e59d353d483b01c5f197d482aa19b
-
SHA1
49d90c73f33117daf8e4d09f72d29250333b3eb9
-
SHA256
43af1a96f644d19e0303523bc99238b4930bde93b3f90243f92dca51d47124b8
-
SHA512
12b056a41f8d4d3b71f246cb14846764ccc65a628954e415a311ec71f5c862f3733dd9c422c5e9c4b6dc5e56852c7099721c263148569d8e314fa64d5fd277c8
-
SSDEEP
3072:6TAosJi/dxqQP/aHCR5yv44TDN+/oEgwXhI7y7DIHkK0DEQ:IAosJi/nqQP/aHscDk/mi9+Q
Score
7/10
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 1 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\549e59d353d483b01c5f197d482aa19b.exe"C:\Users\Admin\AppData\Local\Temp\549e59d353d483b01c5f197d482aa19b.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\549e59d353d483b01c5f197d482aa19b.exeC:\Users\Admin\AppData\Local\Temp\549e59d353d483b01c5f197d482aa19b.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
132KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
132KB
-
Filesize
124KB
-
Filesize
536KB
-
Filesize
124KB
-
Filesize
536KB