Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
-
submitted
25-02-2024 16:49
General
-
Target
a44a084a74e667f33bc1837c98bd84be.exe
-
Size
2.9MB
-
MD5
a44a084a74e667f33bc1837c98bd84be
-
SHA1
edb89e6bdfbd23ea9db33bd66f0dddf2a2ea86db
-
SHA256
4d3d2acd0b1db7d453f373e91a8c6acbd7173e186e5283a0f6cae4f0f94db399
-
SHA512
75b9c331ec2574d15ec77f2d69e3aaa63f374b8511bbf44414059963cf37d327c8978257496a876164a312462557a8914c30c9a3f676c297a5db55687ad33cde
-
SSDEEP
49152:VFqZmzkIVhBNYnAdsh8P4M338dB2IBlGuuDVUsdxxjeQZwxPYRKs:qmYIVXNYA+igg3gnl/IVUs1jePs
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a44a084a74e667f33bc1837c98bd84be.exe"C:\Users\Admin\AppData\Local\Temp\a44a084a74e667f33bc1837c98bd84be.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\a44a084a74e667f33bc1837c98bd84be.exeC:\Users\Admin\AppData\Local\Temp\a44a084a74e667f33bc1837c98bd84be.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.9MB
MD59f065ac26ae908cb275126d23687b2ee
SHA1fcb457ed9d9aff375cf07b841ecbc58dd02564e9
SHA25611a322eb9e5e68022399cc2aae8d9103203305fc515697a238324e31ade450cd
SHA512a6e8c4010f9a86f039c41a57337ae78ca7365bb8277331a85957a64339ea4353561602db9b7848f37150260bbc881f7a2614bbb958279b7a5cccaf1f5343aa64
-
Filesize
4.9MB
-
Filesize
2.2MB
-
Filesize
1.2MB
-
Filesize
2.1MB
-
Filesize
2.2MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
4.9MB
-
Filesize
2.2MB