Analysis
-
max time kernel
117s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
-
submitted
19-01-2024 14:59
General
-
Target
67e88e30b49feb5b7a3ae971b31bcd45.exe
-
Size
1.3MB
-
MD5
67e88e30b49feb5b7a3ae971b31bcd45
-
SHA1
aa5535a7cf7d550d74afeb6712429aaeeecbb9c8
-
SHA256
beae372deaf5556bf6661052184ce56a2fcd0fd3987a35e6549fecbc1a001cda
-
SHA512
658fb9611deedfb3e7aef91202e654ab6f15cf14a9f32fa7bbdb3ac35adf263013967ed987c58e7f06ef7108821d89e521c33675cdc2efa6c7c1c26619513ff3
-
SSDEEP
24576:9KsJBz4L/BjvwXuG24epx0IN/tRPGDhJON9c2XLeQlBg+82C/vG:9KsJBzkBDkuG8pGClIDA9c2KQ7g+
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\67e88e30b49feb5b7a3ae971b31bcd45.exe"C:\Users\Admin\AppData\Local\Temp\67e88e30b49feb5b7a3ae971b31bcd45.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\67e88e30b49feb5b7a3ae971b31bcd45.exeC:\Users\Admin\AppData\Local\Temp\67e88e30b49feb5b7a3ae971b31bcd45.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.3MB
MD586ee05f3c404ed0f73f165dfae1528ec
SHA1cf0584ea2913506be77330bd39e36ccfa9573fa3
SHA256b979ee372dc7afb45d89f0b802ec9516a9a582102f6a05439d21a82a5843a478
SHA51216f415783c3c899cf2ae7a8068f288707db9c6c80ccd0f8273989fe49131a31f27537b200ffbaadce3d965246e7673790e6852c86a963fd558bd1c727ab89868
-
Filesize
4.4MB
-
Filesize
1.1MB
-
Filesize
1.9MB
-
Filesize
4.4MB
-
Filesize
1.9MB
-
Filesize
4.4MB
-
Filesize
1.9MB
-
Filesize
1.1MB
-
Filesize
4.4MB