Analysis
-
max time kernel
121s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
26/01/2024, 20:17
General
-
Target
784bca0e840284a32d43d160a4a43914.exe
-
Size
1.5MB
-
MD5
784bca0e840284a32d43d160a4a43914
-
SHA1
7ed0a99c5d6e8a0af80d5927e91aecd358abf05f
-
SHA256
8aaec19f6028445cb34bafcb3cf3b0b645af410ca5225618154a1053e68ebbb8
-
SHA512
49b8e8dfecb8e8982811d68b7fdf66bec3533e02bb1a0549e81a1bacb8fc326063ff4f366a5e1eed6b16e82b9df807254bc018f547c191444d24e9a20ed341b5
-
SSDEEP
24576:Gu6OquYt7ps3mjvQvjcjukL2xdn+Op4ty+0iWZKAsR+WLodcjukL2Y:GVOs7ps3mjIvjcakLadn+Op4ty+0tZnk
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\784bca0e840284a32d43d160a4a43914.exe"C:\Users\Admin\AppData\Local\Temp\784bca0e840284a32d43d160a4a43914.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\784bca0e840284a32d43d160a4a43914.exeC:\Users\Admin\AppData\Local\Temp\784bca0e840284a32d43d160a4a43914.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.5MB
MD54fb731d2180ed07936965e00b1bbc9b0
SHA1c5eedf2dc837e96fb7b03447b401f55dd9737ff5
SHA25601996016ab506b7800604faf1e95a72015838ca41b8623f732cdb41b660de0f2
SHA5129d66d0b2636b237d054f5ae4aede5688043874d9a4d6a422517573a1e49d33004596218f5bfe4075529dbc2282c5555d58755708005905bd0f39c9aefd707f2c
-
Filesize
2.4MB
-
Filesize
504KB
-
Filesize
428KB
-
Filesize
364KB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
504KB
-
Filesize
428KB
-
Filesize
2.4MB
-
Filesize
428KB
-
Filesize
2.4MB