Analysis
-
max time kernel
123s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
11/03/2024, 21:28
General
-
Target
c1a64ac53e71b7e76cd11598f8fe07a8.exe
-
Size
353KB
-
MD5
c1a64ac53e71b7e76cd11598f8fe07a8
-
SHA1
ed4a7f9a04bba4b52180bd0528bef4a3fc6a69ad
-
SHA256
c68e54891f3f3ab0f51f177e7489b56453897137a5ec4b8b7f5c20e7f643f8f5
-
SHA512
98469ce74f6114fe378560995882b8d9f7f52e29b731c638b4becc7631ec665eaa399e053a5763b0952246ae225431a41dd51f10d9de6dd2d4ce26fb1270c525
-
SSDEEP
6144:YC+9fQMy0gvWfcLvrylE0dCDu9ysKeYdxfsLPrPwo+:A9dyjvdnylE0yu9tpYTfmE
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c1a64ac53e71b7e76cd11598f8fe07a8.exe"C:\Users\Admin\AppData\Local\Temp\c1a64ac53e71b7e76cd11598f8fe07a8.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\c1a64ac53e71b7e76cd11598f8fe07a8.exeC:\Users\Admin\AppData\Local\Temp\c1a64ac53e71b7e76cd11598f8fe07a8.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
353KB
MD5d9e362cbd5668d7d8779c708c8242156
SHA1fdeb3e4b4434126fbd4822845b068b103a094d52
SHA25655950701ac678a8fffc3bb7c8e3678d705df50b55df2521f8ddabffedadc8620
SHA512dc2097857805a494c196b069cb831bcd54d4250a22960585ff66400afea5e956e36b6a3f9b91b4eac573c5c26a4fec9d26096c79bb5e4c120abcb1de58306245
-
Filesize
964KB
-
Filesize
320KB
-
Filesize
204KB
-
Filesize
320KB
-
Filesize
964KB
-
Filesize
320KB
-
Filesize
204KB
-
Filesize
320KB
-
Filesize
264KB
-
Filesize
964KB