Analysis
-
max time kernel
118s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
14/03/2024, 13:48
General
-
Target
c8c35953e2255dd7f30b8ba87ba822d2.exe
-
Size
1.5MB
-
MD5
c8c35953e2255dd7f30b8ba87ba822d2
-
SHA1
908acedd56063efc7c02fe145fb2086bee01955c
-
SHA256
40458929fc4a230dce49efd347b4fa0e39ca9a6b9978ea43837786ec6091ae9e
-
SHA512
ffb129782550ba352bda67c28ceccf3519d316c2ebc0f24ae01840109cf79fda81373bc9818f283e4a2332e263fa3fc41f1e29efdb41130648f4aefbfd72334c
-
SSDEEP
24576:DTTZCbX1lTUO614mOk8lUyCCeaElFV0R7q2RBmEarwaiMd+dZ6IkWfHtTKm3jmtj:VCT/pm6ljCff0Y4mEaUa+dkWfHtuht+
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c8c35953e2255dd7f30b8ba87ba822d2.exe"C:\Users\Admin\AppData\Local\Temp\c8c35953e2255dd7f30b8ba87ba822d2.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\c8c35953e2255dd7f30b8ba87ba822d2.exeC:\Users\Admin\AppData\Local\Temp\c8c35953e2255dd7f30b8ba87ba822d2.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.5MB
MD594768e68c279e80d0cf01334e29711ac
SHA1f28e0fbd5ffd32f4fe478401c5e165b6fbba50b1
SHA256264dcb4643d50f71f239746e4aa47b7b400cfc67d3ab01f523e7c74af2620d8a
SHA5127a89848a874df7a220df29d174a5a9639f52920923303ecd1bc4800b418d4579daf7f0ae415cc8658717fd4f193ee417e548d692240215af6979f6efc5523693
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.1MB
-
Filesize
4.9MB
-
Filesize
2.2MB
-
Filesize
1.2MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
2.2MB