Analysis
-
max time kernel
118s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
-
submitted
25/02/2024, 15:11
General
-
Target
a41a994d9b9a5bb78c2fa588ad2fe4f6.exe
-
Size
1.3MB
-
MD5
a41a994d9b9a5bb78c2fa588ad2fe4f6
-
SHA1
7165d7dc7b93cb7ebf485b8c82b1573930eca742
-
SHA256
665431b8103f73e73d9863e6ee7cdb0f05078361b281a1ee35be450e04ba51dc
-
SHA512
a4182fe30ad1fdda7888e1196b00cc5f98acd60b383672b2e4fdd353ada74ac9748c6fefcc502cf1eaf772551ca8fdbeb994e620b7f26d06f48fa20f9098c8d5
-
SSDEEP
24576:QW6cxcL0XnUjNxrZdcffNsWGQIyzUDLKAqQQcQhMjZszRdk/VGtfgWO:Q1cxcLKUnrrcfOlQIyzUrvQcQhSZRVG6
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a41a994d9b9a5bb78c2fa588ad2fe4f6.exe"C:\Users\Admin\AppData\Local\Temp\a41a994d9b9a5bb78c2fa588ad2fe4f6.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\a41a994d9b9a5bb78c2fa588ad2fe4f6.exeC:\Users\Admin\AppData\Local\Temp\a41a994d9b9a5bb78c2fa588ad2fe4f6.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.3MB
MD57884345e4b6926d7e08260949e7073cb
SHA145a701fc39fc733e09e15e20bd5a812007e9aeb0
SHA25622f956df7924407a3e71f2dc300c415654be6009f2fd38205f5d66389322e7ec
SHA51299e2edd84bc5c84d7857889eb7f3eb8d10a41adf4e7310465e4b2d0d3f504f7965469910327f50d8ab5203d2690efcc2f25b8a93c6095a34256565579a1e2d4c
-
Filesize
4.9MB
-
Filesize
2.2MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
1.2MB
-
Filesize
4.9MB
-
Filesize
2.2MB
-
Filesize
2.1MB
-
Filesize
4.9MB