Analysis
-
max time kernel
122s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
13/02/2024, 13:42
General
-
Target
999164fe59406d5cd0faef7dbb2c6346.exe
-
Size
1.5MB
-
MD5
999164fe59406d5cd0faef7dbb2c6346
-
SHA1
94040d9180fbe65bf47badbc7286d365e0d54484
-
SHA256
1c1980d6344ff7c77c328c38a7274dc78cdded2f12461fe39aeb1e97a5e3b349
-
SHA512
dc53b93fd7412d97d10032241d6d5bf29c9919bbc3c68bae69096b139b31c1840396ed78cdc92ffe2b03dd29c2ffb5b0a374198edb64f97661f201f196f3a379
-
SSDEEP
24576:To/D6H9Vu7cFKWp/99rRJpY9ZaeEI7A3yGEGh0fuMSW:TSM9VfVp1njY9rEI7A3JEGh+S
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 4 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\999164fe59406d5cd0faef7dbb2c6346.exe"C:\Users\Admin\AppData\Local\Temp\999164fe59406d5cd0faef7dbb2c6346.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\999164fe59406d5cd0faef7dbb2c6346.exeC:\Users\Admin\AppData\Local\Temp\999164fe59406d5cd0faef7dbb2c6346.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.5MB
MD541630340632abf1f71c8f2f9f3a90a5b
SHA1bedb532901fd55151e1704f4eb99be77f9919e32
SHA25662e30d2409b5882e600c5feab4e27fdc5676e2fca564a8b697009a3ca36cf555
SHA512754851f3a46c2d5dcf99800548b5f8cd36f94a95892c79c561d3f8ac32663272634230c2844a00ad891b9dac0dec16bd0c7572f2e670fc293825a70d1560e3ba
-
Filesize
4.9MB
-
Filesize
2.2MB
-
Filesize
1.2MB
-
Filesize
4.9MB
-
Filesize
2.2MB
-
Filesize
4.9MB
-
Filesize
2.2MB
-
Filesize
1.2MB
-
Filesize
2.1MB
-
Filesize
2.2MB
-
Filesize
4.9MB