Analysis
-
max time kernel
117s -
max time network
117s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
-
submitted
14/02/2024, 06:02
General
-
Target
9af209808b954bc2f6b28eaaa321617f.exe
-
Size
59KB
-
MD5
9af209808b954bc2f6b28eaaa321617f
-
SHA1
99ac3095bf0c76fe733397d1f5c1d3dfad59f799
-
SHA256
6fe542a4ff3aabbc2d3cb536f1a0c84fe9fc8f04630c893edcf91bbc08e60e59
-
SHA512
41084b12fd036a155688517f87a44d0e0bd1dcb35f4b8d2eea3cf0b634ac58fe26efa44e1b920c211c5e25f26f5edbab97fd77dbe0c7bd07a2e933b65e4a46e3
-
SSDEEP
1536:3Ff3jL7tLR5EP2pT2rU1XhQdvvjJAkVyJrscCvOoYqD8:3JTvtLDI2R6UxhQdT2bSOoYqD8
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\9af209808b954bc2f6b28eaaa321617f.exe"C:\Users\Admin\AppData\Local\Temp\9af209808b954bc2f6b28eaaa321617f.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\9af209808b954bc2f6b28eaaa321617f.exeC:\Users\Admin\AppData\Local\Temp\9af209808b954bc2f6b28eaaa321617f.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
59KB
MD5992fa9e30df6f13fb4a0bad54e3771a8
SHA1a0b914a6b70660edb713fcf69e3765b72e52264b
SHA256c4e4d5e6db3f43e12e2f5d42712bd26b1955d681cbb0810ed7cd46a2d6329daa
SHA5120143724be2e8f7b845dfa9f35501f69d8378eab2f16603b50a30552f70fb3f4b529d39fd562ae49a9cccf00a2b6ef1e474dea58e3a501fa9b555f0719ed5cf22
-
Filesize
116KB
-
Filesize
244KB
-
Filesize
60KB
-
Filesize
56KB
-
Filesize
116KB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
116KB
-
Filesize
60KB
-
Filesize
116KB