Analysis
-
max time kernel
120s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
27-01-2024 18:04
General
-
Target
7ae9047ddeac6d51836ff1601ed26cf8.exe
-
Size
1.3MB
-
MD5
7ae9047ddeac6d51836ff1601ed26cf8
-
SHA1
6fb4695a7101248a24ad988a059ea4790d6a1f91
-
SHA256
74683fc7a0d72c77e1fa75403c7982881ddbfb251c47d466d65a11617779948a
-
SHA512
4042d05d1a2d30f36119201c98450c4bf858db5997701cd7f5ab9e915691d3574b45b2cc0d35f13c1f653211c364438346268d716b509f6e80589924b82ed0ee
-
SSDEEP
24576:fXjriIqRxXFt2W2PIMYu09sosDln8ekd6uqsFfHew2zOKfEw6PDb3svvG:PitUPPIBra11896uqsB+V/sTb
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 4 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\7ae9047ddeac6d51836ff1601ed26cf8.exe"C:\Users\Admin\AppData\Local\Temp\7ae9047ddeac6d51836ff1601ed26cf8.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7ae9047ddeac6d51836ff1601ed26cf8.exeC:\Users\Admin\AppData\Local\Temp\7ae9047ddeac6d51836ff1601ed26cf8.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.3MB
MD57fad11a9af95ec0357f05e076f2c1308
SHA1d3bcd78db38203b8237da76e2ee2d6762e90b540
SHA25647d0c366cf24819db2a04c62b65cac695030ca05569486fd8c3c8c0975309274
SHA51297fc189490327e3dc79ca5c56acc3d6c222b0cff512506704810b59b747b9d1aac8dbeeb843ce6dc6749f556181ad6beb1bf81ff70625d67fe0045534a7cec7e
-
Filesize
4.4MB
-
Filesize
1.1MB
-
Filesize
1.9MB
-
Filesize
4.4MB
-
Filesize
4.4MB
-
Filesize
1.1MB
-
Filesize
1.9MB
-
Filesize
4.4MB
-
Filesize
1.9MB
-
Filesize
4.4MB