Analysis
-
max time kernel
118s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
13/03/2024, 16:44
General
-
Target
c6602030c951a5b45c92d2837f982470.exe
-
Size
5.8MB
-
MD5
c6602030c951a5b45c92d2837f982470
-
SHA1
e39d1347aadeaaa33eaa11cd20d106f9cfb3232a
-
SHA256
974a44a9064a8382a42c5c15439cc8755c35a9590fa4dd2645005c5c7090b240
-
SHA512
eeeb2665596022c046e9adf24a3289a4d8d9c340ef972b3e4d699d6fd14e16331023be648a2eae09e780e37855d714db0fa8976a4b31992d4e04ab9ba0e1c0f8
-
SSDEEP
98304:7HflUSAIvmIhgHau42c1joCjMPkNwk6alDAqD7z3uboHau42c1joCjMPkNwk6:T9UWvmIhyauq1jI86FA7y2auq1jI86
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c6602030c951a5b45c92d2837f982470.exe"C:\Users\Admin\AppData\Local\Temp\c6602030c951a5b45c92d2837f982470.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\c6602030c951a5b45c92d2837f982470.exeC:\Users\Admin\AppData\Local\Temp\c6602030c951a5b45c92d2837f982470.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.8MB
MD5373a0c33d644ac3a3fa17c9b02be37fc
SHA1b6d2238eaa499e4404371c611a322a3f5b4b6581
SHA2561cfd31cfb21fc43657597ed5e8359212c2fcb90cfbd5545a8e5d3af89936ee8c
SHA512b7b21e4db6dba62f292352caa42ff254aae8be577347de8b71e4cccbd678f9506afef818f08ce4b11cbe36db52afcd3671faa11f153afdebc622ba2cacb25f61
-
Filesize
1.2MB
-
Filesize
4.9MB
-
Filesize
2.2MB
-
Filesize
4.9MB
-
Filesize
2.2MB
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
2.1MB
-
Filesize
2.2MB
-
Filesize
4.9MB