Analysis
-
max time kernel
121s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
19/03/2024, 17:32
General
-
Target
d6b61543939ea364f0bab55f0e67b858.exe
-
Size
5.3MB
-
MD5
d6b61543939ea364f0bab55f0e67b858
-
SHA1
e5bac254b5e947071612e0788f1240010fcf4b12
-
SHA256
c283eb0d004215558dd510f119d9eedde9f230636e830764308ffede0ba7d93f
-
SHA512
b64d943b901f0fed3fea18a24349c1a1aaf2ab0c1350478cc8158c3aca11fa60418aaed6628d1bed622a8d972c5cdd827a8e90dc89a66809c084c938a5d1e568
-
SSDEEP
98304:NIFE/HXTwgPLdcbrJMtLZ4FTyOkqkrijMHAiBPTsBJc+brJMtLZ4FTyOkqkrijMH:NIFErLdcb46ByOkyMHLBrKpb46ByOkyG
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d6b61543939ea364f0bab55f0e67b858.exe"C:\Users\Admin\AppData\Local\Temp\d6b61543939ea364f0bab55f0e67b858.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\d6b61543939ea364f0bab55f0e67b858.exeC:\Users\Admin\AppData\Local\Temp\d6b61543939ea364f0bab55f0e67b858.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.3MB
MD54b3c00ab6109a2c9ebd9f82b3c29bdfb
SHA136f8bbad292ae0fa7cb38b9c66daf0d3040763a1
SHA256b660c27c2959f3346d549135d451c7535c8ed1744d25597a429ab2006bb92215
SHA5120a333724fd4f13eac41254fb476d5fa426a1153d0bf364d5bdf8c564ff19121a5a6228553f73b1a001b7070fe2b0db2d07f42a53b9c7ae798be42681cf749aa1
-
Filesize
4.4MB
-
Filesize
1.1MB
-
Filesize
1.9MB
-
Filesize
4.4MB
-
Filesize
1.9MB
-
Filesize
4.4MB
-
Filesize
4.4MB
-
Filesize
1.9MB
-
Filesize
1.1MB
-
Filesize
4.4MB