Analysis
-
max time kernel
119s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
19/01/2024, 04:44
General
-
Target
66bab12854be37d1476705de07334f8f.exe
-
Size
1.3MB
-
MD5
66bab12854be37d1476705de07334f8f
-
SHA1
3fc3c758d87e188d1bd23f6b41c5b94be1fcd400
-
SHA256
6589c584740db9ddfa6929ed6610e86bf6762be51898c59a3faf7e04b5e6cd6d
-
SHA512
21e665eba4bda87d262050bedb99f6041c8eb2cfca7c3717106a8dc035de8859894cd7c03d77c045907059f2614b3fb6d941d5499f212d47a392efe595d0029c
-
SSDEEP
24576:Ae0XCbaaHEiTLZoKWY80J3XnT9VQGVU0FqWjLk4P7v9H7M1WO:QCmWvZ6I3DgGVUAAwEf
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\66bab12854be37d1476705de07334f8f.exe"C:\Users\Admin\AppData\Local\Temp\66bab12854be37d1476705de07334f8f.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\66bab12854be37d1476705de07334f8f.exeC:\Users\Admin\AppData\Local\Temp\66bab12854be37d1476705de07334f8f.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.3MB
MD516b3187fe942719b0221cadc40eadb66
SHA10a068bf4df7a65557b4427dca043c171ff7c147e
SHA2566b7b75139018605f8e671920b81e6e1e299e61a5e9658886e5fea5e3f5b16f99
SHA512cfcfe12b10298e36c4fe755be23d75396da6497282efcb48fae9690efeaae7fb26564a6b9a3719057d82cb5a1c76579874698cd3beced66eb46037337ec82e02
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
4.9MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
1.2MB
-
Filesize
2.1MB
-
Filesize
2.2MB
-
Filesize
4.9MB