Analysis
-
max time kernel
120s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
12/03/2024, 09:53
General
-
Target
c3110aa92d1818212566fc729dd70176.exe
-
Size
133KB
-
MD5
c3110aa92d1818212566fc729dd70176
-
SHA1
28421e2d6c8124174b7e4b905dc060f97f18796c
-
SHA256
19d7fc2e2ffc45c18856f71a6adb70ac6d42bb3fcc485ed7455f69453cae6d52
-
SHA512
b988758de2d95c88bc2d199d777fff5661fdf9a73a6fcf506511abfe2a350b2fd74b3523be31ac437f8a8a91e87e93f432882121534e5a00e4583c23c8ca9a7c
-
SSDEEP
3072:ibRW0dacj5ShZLM96lJNhOprM13ukWpnp+fj+BAXQ:i1W0ocoG96lJNgZM1jqncPQ
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c3110aa92d1818212566fc729dd70176.exe"C:\Users\Admin\AppData\Local\Temp\c3110aa92d1818212566fc729dd70176.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\c3110aa92d1818212566fc729dd70176.exeC:\Users\Admin\AppData\Local\Temp\c3110aa92d1818212566fc729dd70176.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
133KB
MD5e3796e5080823c4cb3936134f593f31d
SHA190ad354dce373060140c519328229e882a162389
SHA256882eb71ada37dcb1ed8dc555821cc2220d68228b559dec7d34b3f7a78ddb7e18
SHA512b93d7357277f97d5ab9377d864d46ba66105b2ad20c34fc01742f2e8692875c268aeba97ebf709c8c34ef53a31c8d21db43d3e7c0ee60d853e686caa639ed226
-
Filesize
536KB
-
Filesize
124KB
-
Filesize
132KB
-
Filesize
124KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
132KB
-
Filesize
536KB