Analysis
-
max time kernel
117s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
04/02/2024, 13:25
General
-
Target
8f4373bb7dde9a8db952c881fda9a073.exe
-
Size
1.3MB
-
MD5
8f4373bb7dde9a8db952c881fda9a073
-
SHA1
1f0bbed979854ba14896dc7fb80fefc65a5b533c
-
SHA256
a4f10ea5c5533a19d754c662063a721c56b839d445a721d8154d8311553382df
-
SHA512
37fd1329fef6cbd9fbf7f9028582bd395d9bc56d00a89e65948b2554e964450ec3cb9445335b793dfe228541bc98f378f53d196bd09e8e3ce1f8c08042cedce2
-
SSDEEP
24576:6Vz2H+zbqjFWtPTEtvKPdtu1Jon+AkLo6JokIb153vG:6z2H+znTEd719H
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\8f4373bb7dde9a8db952c881fda9a073.exe"C:\Users\Admin\AppData\Local\Temp\8f4373bb7dde9a8db952c881fda9a073.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\8f4373bb7dde9a8db952c881fda9a073.exeC:\Users\Admin\AppData\Local\Temp\8f4373bb7dde9a8db952c881fda9a073.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.3MB
MD5ad70071236a784515d6b95260b096101
SHA1af6b907ba61596935e00cc9dc42be22093638244
SHA256e3b7502f7951acec19d813098e95157c9932450f99e57f688284aea748e0c917
SHA512509494b0381f975870412a2be278979c4ea573e57813107da1695db7b662e34383dcfcf3690e08e9b17d209af357f77d5ce406fb14d117b3bce5865f32e13ec9
-
Filesize
4.4MB
-
Filesize
1.1MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
4.4MB
-
Filesize
4.4MB
-
Filesize
1.1MB
-
Filesize
1.9MB
-
Filesize
4.4MB