Analysis
-
max time kernel
150s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
11-03-2024 01:33
General
-
Target
bf7e052ab31d773942b1ded15520c7f3.exe
-
Size
24KB
-
MD5
bf7e052ab31d773942b1ded15520c7f3
-
SHA1
ba2f288a9bc50f16d25421a0dcf629758ca52a25
-
SHA256
e77160fbf8a1b25edfb2d235127162f0de19fd30af4c136d220fe674b002b544
-
SHA512
d24cf454a5dd878249e2d04d6df6852d1399328cb48ba7b74410d5acc155b65de6599c295322a38e816ef0bbbf0065021374315ce5e8b7c5d1ff17f58449a34f
-
SSDEEP
384:ZLIR145WA+rS/EsMmRBtKyu9kw+CBY4TmbLJNcdrnYh8TPzdfeOKmE/AhWcu:Jh9Z/v5BLTOqlNsrnuCPzFeOK1Awc
Malware Config
Signatures
-
Adds policy Run key to start application 2 TTPs 2 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\bf7e052ab31d773942b1ded15520c7f3.exe"C:\Users\Admin\AppData\Local\Temp\bf7e052ab31d773942b1ded15520c7f3.exe"1⤵
- Adds policy Run key to start application
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\imsmn.exeC:\Users\Admin\AppData\Local\Temp\imsmn.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
6KB
MD5d03b25f1662a26d6922e6d24828cd509
SHA17d3c8e5c4ade92e6d692a63a2fc8b56089dc6193
SHA256f34dc3e7292f569c454bc492c9bf3e19c3cb4650dc2397b6437367facb2e39dd
SHA51269cff54d7f0f48a28a0f338d47ec6a599d83968972983a778577bedd7d830a831ad6adb29ad000c63d94d9ae625e74555bfb45c1d257aceb3d44be1814c82d8d
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB