Analysis
-
max time kernel
121s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
13-02-2024 01:38
General
-
Target
982791bbdec792a81d027a65865aedde.exe
-
Size
56KB
-
MD5
982791bbdec792a81d027a65865aedde
-
SHA1
403140d6d3c073d4a7a7a9d6fe60a4cc29db0070
-
SHA256
b316493de2af36fbf5ebb100d6d1410a2b8b542ff880ee65b3113f32d1947b32
-
SHA512
a53b6cef2efdbaa72055845d2d1568f93d5e7960c09e2303ba7b442fb7ae18700a35c5f4db30cff40c933bc6d949067a83a36f021d56a05007b8c2d866deaa86
-
SSDEEP
1536:UlKinCEM2DHo7Scl62iT0c31im36IQdax9KYyxV3e:Uo8MAcSK6D0cH6Yx47xV
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\982791bbdec792a81d027a65865aedde.exe"C:\Users\Admin\AppData\Local\Temp\982791bbdec792a81d027a65865aedde.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\982791bbdec792a81d027a65865aedde.exeC:\Users\Admin\AppData\Local\Temp\982791bbdec792a81d027a65865aedde.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
56KB
MD5bc2cd02b114034d92084dccfe0674f76
SHA1c96a648d99f3cb04293ffca820dc9a2009830aff
SHA2565e7cc4db777f3965c6196a7a91dc715755027f2e410684bca814fe8b1318dfee
SHA5124d5793ad24cadd72112351b08ba90059ad8fd5cdfe94ee9dd5418e7604d7bf2dbd4e1d3a141c51458d1c04cc365118589eb00cf1384b4b24e6d92aa41ee93dba
-
Filesize
232KB
-
Filesize
56KB
-
Filesize
108KB
-
Filesize
56KB
-
Filesize
108KB
-
Filesize
232KB
-
Filesize
232KB
-
Filesize
108KB
-
Filesize
56KB
-
Filesize
232KB
-
Filesize
108KB