Analysis
-
max time kernel
119s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
13/01/2024, 16:27
General
-
Target
592f681a5b405d96516160163cde0273.exe
-
Size
1.3MB
-
MD5
592f681a5b405d96516160163cde0273
-
SHA1
d7bb08364b625144df4942eb89e377cd9a58b396
-
SHA256
dd0b79d1c19ad56e3c0e8b64804aa9e53495e0a0f51a7fdd8a3108c6b71f2cc3
-
SHA512
8e9df748656e9eb0994768be1d9656b1b45de6b1f23f8bf4fea40991ae776a20ce49f8293b155ac609eb8b8e996e04fce8e1dda08b1f3023e50c72925ba7954e
-
SSDEEP
24576:KU+H7o5QseF3w92qoiCTFmJlIC97aerF2dTUsqqsBZkRGXBdFIRHscvG:9+7KQ5k25ut97aerFi2goHFIR
Score
7/10
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\592f681a5b405d96516160163cde0273.exe"C:\Users\Admin\AppData\Local\Temp\592f681a5b405d96516160163cde0273.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\592f681a5b405d96516160163cde0273.exeC:\Users\Admin\AppData\Local\Temp\592f681a5b405d96516160163cde0273.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4.4MB
-
Filesize
1.9MB
-
Filesize
1.1MB
-
Filesize
1.9MB
-
Filesize
4.4MB
-
Filesize
4.4MB
-
Filesize
4.4MB
-
Filesize
1.1MB
-
Filesize
1.9MB
-
Filesize
4.4MB