Analysis
-
max time kernel
117s -
max time network
117s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
-
submitted
15/03/2024, 05:52
General
-
Target
caa4ec21f72acb28f4d8e82ea6fc670d.exe
-
Size
115KB
-
MD5
caa4ec21f72acb28f4d8e82ea6fc670d
-
SHA1
ac3ba0f7c03ef13b2a45b7655448d4ecb7569a76
-
SHA256
c3d5ba9d5c02f0ffdbdd0c6ce09b6dc466fc07b4cc3d48de64f08be5c3e66df7
-
SHA512
89468967d19fdc2edb6a7e0859041a90651b5f4bb516431eac109dae3f5000cf2eb699c902779053a6a9ac4da412104d106142fe17477844c1be08e9a2857936
-
SSDEEP
3072:QKKOnBWzPMpW8UnrP4nW6YvOCKkG4QeIN:QKKCWz38qT4WbnDRI
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\caa4ec21f72acb28f4d8e82ea6fc670d.exe"C:\Users\Admin\AppData\Local\Temp\caa4ec21f72acb28f4d8e82ea6fc670d.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\caa4ec21f72acb28f4d8e82ea6fc670d.exeC:\Users\Admin\AppData\Local\Temp\caa4ec21f72acb28f4d8e82ea6fc670d.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
115KB
MD50d254a0ca674ea5c1058bbcebd70bbce
SHA1bdd47a2c61f538e1cfae16e367e40bbb2b90880e
SHA2568670d56843126b1c4d0ce7df68073c46f60e0811b4136974433514e63accbe84
SHA5129399ccc17dfabe9b64932ecb5dab7d5d5e4c9d5fda025992ba702bbe4ef6c4c8e58c0add2ce025237fb90e39a4bc8f0d756b928e44ad04f4ba49f3c89a24e334
-
Filesize
468KB
-
Filesize
116KB
-
Filesize
116KB
-
Filesize
116KB
-
Filesize
468KB
-
Filesize
468KB
-
Filesize
116KB
-
Filesize
56KB
-
Filesize
116KB
-
Filesize
468KB