Analysis
-
max time kernel
117s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
-
submitted
13/02/2024, 10:59
General
-
Target
993f6fc2b55532203157cb951699037c.exe
-
Size
1.3MB
-
MD5
993f6fc2b55532203157cb951699037c
-
SHA1
c9b1619f6eca1afce38a5e89c5e91c8f08ddd7d6
-
SHA256
55a51b1444d9d07bef92772b898ea8b75fac39037061aca7bf680fca630213f5
-
SHA512
cb5ce77afdc7583cc31746cc8f8e371a2036a3e72d73bcb72f38fa0fcdf867401884f4c7c916fbccd0272a9c222486601483fa28e718eb6d917725172357f3c8
-
SSDEEP
24576:TSMlepViVReaerdggVdb7Wmt1RlSPis8qN3cRZwhb+HkUyFmWH56UghlcvG:T3+sYL5Ymt1SihRIb+EUyZHgU
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\993f6fc2b55532203157cb951699037c.exe"C:\Users\Admin\AppData\Local\Temp\993f6fc2b55532203157cb951699037c.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\993f6fc2b55532203157cb951699037c.exeC:\Users\Admin\AppData\Local\Temp\993f6fc2b55532203157cb951699037c.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.3MB
MD5808adb360df80c2271b31bb33573cfc3
SHA16c3bb675f07444ccf88a67c40d2ca61a6a086303
SHA256c4f896d2ebb4d17630c9c919e7ac88d453fee7e54c87d06e9dff627ef84fb0d8
SHA512c8ce2b3e64a8adc3c51ce826754a705b583c689335562a98f91702b2d52cd38955b3e67e81ec15c104b6bd75082c8246792df6cccfad359a27b1f4691e1e102a
-
Filesize
1.9MB
-
Filesize
4.4MB
-
Filesize
1.1MB
-
Filesize
4.4MB
-
Filesize
4.4MB
-
Filesize
1.9MB
-
Filesize
1.1MB
-
Filesize
4.4MB
-
Filesize
1.9MB