Analysis
-
max time kernel
122s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
13/02/2024, 18:14
General
-
Target
99ce3bdc622121d6659d28cc39daf5b3.exe
-
Size
1.5MB
-
MD5
99ce3bdc622121d6659d28cc39daf5b3
-
SHA1
8baf1bde8d3b2e290055d5428ebeb539e04bdafb
-
SHA256
181bed91b6b493f02e5473c37e38e48a6f0c3fbb2d9d725f21f4f5089eae92f0
-
SHA512
4d1ce27a7ad80e7bd5c1cc6b8a572087bda525e1a08b150c7cfb50a5996b371e0fb23dcbefaa4ef827914bb52bbf9044d3ede62182eec6fc491e9c5a95ffb5a1
-
SSDEEP
24576:auuRniEJhMVVhO7olEcBxNbaC99I8bKL6t+qrl4cq2jV0/tu7L30EGvXHnnXkX8y:aV1fMU75sxp19pY6tQ2Yu7L30EkHXkX
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\99ce3bdc622121d6659d28cc39daf5b3.exe"C:\Users\Admin\AppData\Local\Temp\99ce3bdc622121d6659d28cc39daf5b3.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\99ce3bdc622121d6659d28cc39daf5b3.exeC:\Users\Admin\AppData\Local\Temp\99ce3bdc622121d6659d28cc39daf5b3.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.5MB
MD5264463cc4d7425bd9067967d5483700a
SHA1b78bafa9f9de7e6832758aa6abc796ddf032bd95
SHA25611008e68a6ece583e7ff7de0d72473037a1b05d1dadb01bf0052015c580b3945
SHA5121b25c54a81fbe939fd598393d46c657bf7d248996f074f0124f4ecd22c1329e36f8f47d1b40ca65d4dcbc74dd1f6c5716c9a78d47c35ec241d4b31265b11d6a4
-
Filesize
4.9MB
-
Filesize
2.2MB
-
Filesize
1.2MB
-
Filesize
4.9MB
-
Filesize
2.2MB
-
Filesize
4.9MB
-
Filesize
2.2MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
2.1MB
-
Filesize
4.9MB