Analysis
-
max time kernel
120s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
25-02-2024 11:28
General
-
Target
a3aa500da07df0584c0df38aaaf91171.exe
-
Size
1.3MB
-
MD5
a3aa500da07df0584c0df38aaaf91171
-
SHA1
e4140c49c903a62b90086e791537d8d178842449
-
SHA256
3177d49df15bbc09f5082e297a55978e4126594475415d558be2ca839e063ba0
-
SHA512
b3a5e5bab6f2fe3b3a4c1d12e1ab32e62257a6d08b5877ca70519eeeaa5f434159cb7d65aae1f729f7e0711b6749fec2277c1945b5b790e88c6b990c2ea57630
-
SSDEEP
24576:w492nrsPXRd99a1SCzQbjv/X2FEtxzJO5uptGY5mQ0Wc:w49SsPXTjySCzQnv/mFsbO5fQ0p
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a3aa500da07df0584c0df38aaaf91171.exe"C:\Users\Admin\AppData\Local\Temp\a3aa500da07df0584c0df38aaaf91171.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\a3aa500da07df0584c0df38aaaf91171.exeC:\Users\Admin\AppData\Local\Temp\a3aa500da07df0584c0df38aaaf91171.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.3MB
MD509f0aca04814e9b4202f95ca5ae91e27
SHA1d95a5bbc07fdab739a1bb0ffba6614d6c3702fa0
SHA2569ce083500e2233f8e4716fcaab54ed28ac58b02eef22b6d611fa862c142954a6
SHA512f4b8bc14f80565dec8d25ea102a428ddf65aef3732636e5d19c2e89aed0783a86f8bf456f914041070c8ad2f534e2a89b36d284dd93125eb607b36dcb33dca51
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
2.1MB
-
Filesize
2.2MB
-
Filesize
4.9MB