Analysis
-
max time kernel
119s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
14/03/2024, 21:12
General
-
Target
c9a1b684961c8e29a7ca1be5b66a0d0d.exe
-
Size
1.3MB
-
MD5
c9a1b684961c8e29a7ca1be5b66a0d0d
-
SHA1
9a59fb9c9318780dfaec6e44797982893af23509
-
SHA256
b4e96cba10d649fe9bf9abaf19478e85ec4a784ff2cf17fb1f0fd3f756732a65
-
SHA512
6fb2979670b6b7ab4c8e8860392fb5eb62e55a3a0f4772a7b4f6324a39e65e3560b74ed6c07a2a2a2756b5a50dff1f31c20357dfae7b1c6252ab3dcf7009835a
-
SSDEEP
24576:aBoQOkXyjZ3UqjEwn1pzs6YDjJDEwxsO4fkOsazWIepnogwezcewb7VD1BWc:aB5X6Cqv1pY6gqnk+z+ouNwb7Vzp
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c9a1b684961c8e29a7ca1be5b66a0d0d.exe"C:\Users\Admin\AppData\Local\Temp\c9a1b684961c8e29a7ca1be5b66a0d0d.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\c9a1b684961c8e29a7ca1be5b66a0d0d.exeC:\Users\Admin\AppData\Local\Temp\c9a1b684961c8e29a7ca1be5b66a0d0d.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.3MB
MD5fcd7e3e482ce240cbe99329b2c99371c
SHA130ada28803a75c462494a942c3d3249370bc15be
SHA2561f601af4ad538bc2a31488957c0ebcf97ee9c479ca2fdd7a308106b66a7f8dd9
SHA512684fa863873656d50239f82d35445bca9415bd1c1d8f37fcda0dc5851dbcccebc09c75113eff202b93bece28bb4cc65f4179330c40d2c0a6c4212f486823afc9
-
Filesize
4.9MB
-
Filesize
2.2MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
2.1MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
2.2MB
-
Filesize
1.2MB
-
Filesize
2.2MB