Analysis
-
max time kernel
110s -
max time network
239s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
18/01/2024, 22:32
General
-
Target
6633c193aaac9d205def4bcaac387151.exe
-
Size
2.9MB
-
MD5
6633c193aaac9d205def4bcaac387151
-
SHA1
da47f82d1df3b81a5f473e645fe5032e7cc74a81
-
SHA256
c789575ddfb8bfcda1695c1fa9076c8e1b252b5bc40c4b98e57f3e9d9fb62c92
-
SHA512
4a76df31bc0196dea1e1c745317948516a139d3165ef4311bbbe8c793ad1760eb66e0a3386c4f5d8c8b12f12b006a94e98791d3640c221f1cc6713c8bab15b07
-
SSDEEP
49152:GFISbCdCczg8d0j81g1eZPLfP4M338dB2IBlGuuDVUsdxxjeQZwxPYRKs:GFOscoYZzgg3gnl/IVUs1jePs
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\6633c193aaac9d205def4bcaac387151.exe"C:\Users\Admin\AppData\Local\Temp\6633c193aaac9d205def4bcaac387151.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\6633c193aaac9d205def4bcaac387151.exeC:\Users\Admin\AppData\Local\Temp\6633c193aaac9d205def4bcaac387151.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.9MB
MD5d4c7ef6dde72bea138af9565cb37aebb
SHA1cc6dc04f26fc75f715c6346b1ccd3d69645f7b48
SHA2569049a6e15057120c51ae673c68bcc7fd439242e7509e37581dc649cd15ceb7ff
SHA512130c474353312ad0d80c4600310a2a2d9df329bad49a1b59f24d74c224d9f5514af9248689eb89bae18b2f7b10e85b3a3c00e926c7066d38483477fb0b7c153f
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
2.1MB
-
Filesize
2.2MB
-
Filesize
4.9MB
-
Filesize
2.2MB
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
4.9MB
-
Filesize
2.2MB