Analysis
-
max time kernel
118s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
13/02/2024, 22:41
General
-
Target
9a1a854b8a02ca2baf96bcb2a6d1372b.exe
-
Size
1.5MB
-
MD5
9a1a854b8a02ca2baf96bcb2a6d1372b
-
SHA1
bae796d677cc55b445a38b76820fa300a1bc815e
-
SHA256
91eeb9f1fcedf27633108f8f79532c020fee8c6967aafd5864a776cac1e90f7b
-
SHA512
24bdb8c807cffe502b2fb75f511bad7b83ddb862d318d52621510597130a2b475e07dc1345b56cdef8b518a048b1b62ba0cdd72eafab16759e6544ba1d81bf9c
-
SSDEEP
24576:j0gNKdxjsZA/FiRenfniRFiDwQG1fOIdUNN/Faivs7AmOCXW:j4FsZumenfiGHG1fODN/ha/OCX
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\9a1a854b8a02ca2baf96bcb2a6d1372b.exe"C:\Users\Admin\AppData\Local\Temp\9a1a854b8a02ca2baf96bcb2a6d1372b.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\9a1a854b8a02ca2baf96bcb2a6d1372b.exeC:\Users\Admin\AppData\Local\Temp\9a1a854b8a02ca2baf96bcb2a6d1372b.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.5MB
MD54d3317c790fa72330c0f26e1b11be3fb
SHA19abad20510ba265f4366bfe34f209a5776ee9f30
SHA256c8003a5557390ebfe26e6311383824e488586979692557b27f3abb4fb260d485
SHA512ccd457d3f7852dae42e3053ac3f6f60b01eadddb039a07c1722377b4e6d128fea09cd88cfac27655eddf79bcc3c72b31716a261ecdf224ec984fc643e6f454d3
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
4.9MB
-
Filesize
2.2MB
-
Filesize
4.9MB
-
Filesize
2.2MB
-
Filesize
1.2MB
-
Filesize
2.1MB
-
Filesize
2.2MB
-
Filesize
4.9MB