Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
-
submitted
07/03/2024, 16:48
General
-
Target
b92ec5bc625a20dc2057d1c04e27a266.exe
-
Size
2.9MB
-
MD5
b92ec5bc625a20dc2057d1c04e27a266
-
SHA1
e9f428d7676f6bb408ea608608332573a8ea2f15
-
SHA256
ee46582ae0440af4246e14c3aacc33d55359906f663daa4d074b1f4cf0238677
-
SHA512
c7e42f1db7448a1e5e311ad06942094d6ed15c1c2b07a8cb4081aa91e80d00d9d7bee4d1c05704520f8d995770d82469629e7b5b1df639391e4f9c826d68ff72
-
SSDEEP
49152:THzqtPiqd1jlK/WanEcCXtIcgP4M338dB2IBlGuuDVUsdxxjeQZwxPYRKs:QqqHxK/WPagg3gnl/IVUs1jePs
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b92ec5bc625a20dc2057d1c04e27a266.exe"C:\Users\Admin\AppData\Local\Temp\b92ec5bc625a20dc2057d1c04e27a266.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\b92ec5bc625a20dc2057d1c04e27a266.exeC:\Users\Admin\AppData\Local\Temp\b92ec5bc625a20dc2057d1c04e27a266.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.9MB
MD52e701875c9ebb61fdbc3f64aa29047e7
SHA1fb58843ac127b28c509bb87fafc442a1e1238f31
SHA256a79141f445b14219713efd5fcdddf35c5a7b0451626de9dcddc6858bd60b41ba
SHA5127b511e9d8c795c6f40ef50cac9077e655826f85f9e4b773dbd2829b7064ae94f491ae1e40bb64cdb3c22e229a15b628b54bc43d9e73e075f6c8206a04d2ef590
-
Filesize
4.9MB
-
Filesize
2.2MB
-
Filesize
1.2MB
-
Filesize
4.9MB
-
Filesize
2.2MB
-
Filesize
4.9MB
-
Filesize
2.2MB
-
Filesize
1.2MB
-
Filesize
2.1MB
-
Filesize
2.2MB
-
Filesize
4.9MB