Analysis
-
max time kernel
117s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
07-03-2024 22:39
General
-
Target
b9d75ea5b105f973b10c0a6028051b3f.exe
-
Size
1.3MB
-
MD5
b9d75ea5b105f973b10c0a6028051b3f
-
SHA1
3ad94bc39c9827f6ae7135b2fe0e6d10c626f1ad
-
SHA256
5157c7773443db0cd93493f560ceef42e3d69f7cc973cfbc485da59470027d37
-
SHA512
29d5a1aa0194dd5bb2bd342cc438f7a33a8cfbf2cab04105d63cebfcc34d7d94b7219ab082f1b9c7bb5b4d94eec81cda9d5db541383dbdcb05e8e60ea4dd15ec
-
SSDEEP
24576:0JS9nPlw/C0mXQ8g5Z7cEsik7sSavB+GhYymvpZq/56EiZXxolD2DQRvG:YSR6/C0oLgvgk1omYZpZ86xqlD2U
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b9d75ea5b105f973b10c0a6028051b3f.exe"C:\Users\Admin\AppData\Local\Temp\b9d75ea5b105f973b10c0a6028051b3f.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\b9d75ea5b105f973b10c0a6028051b3f.exeC:\Users\Admin\AppData\Local\Temp\b9d75ea5b105f973b10c0a6028051b3f.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.3MB
MD5da3d6d91dd89bc66bd4ec6af6b5dd0db
SHA1179354fc8ac2e66d26246746307420c3265deef8
SHA256c940b9b72beec1345f75caa292112fa8d64bd93181ea5b558fa27e855d2cc7c1
SHA51232ec79f6039f3740d1988d1bfc41efb8c5aace83a29043ee7f7c651f5395cb908019863b4ebce36f618063bf6308a46b4d4966392d95a34a779a6b58e26dc1ef
-
Filesize
4.4MB
-
Filesize
1.1MB
-
Filesize
1.9MB
-
Filesize
4.4MB
-
Filesize
4.4MB
-
Filesize
1.1MB
-
Filesize
1.9MB
-
Filesize
4.4MB
-
Filesize
1.9MB
-
Filesize
4.4MB