Analysis
-
max time kernel
117s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
-
submitted
26/03/2024, 15:11
General
-
Target
df7691cde6502804fa2f7ceae1133136.exe
-
Size
1.3MB
-
MD5
df7691cde6502804fa2f7ceae1133136
-
SHA1
45e6d344b9ec672e4e8f9c2c08c7636835ed0caf
-
SHA256
8333a861f70c2864d07741ddf3872777f1599fd22bd76a06c22e64db195db78c
-
SHA512
96ad20ef5ca1e0e31aa7c5ebc082ce050b9bbee46496adefcfce6fee5584fa68ee28589ea6dae3e3aaa79342bbf24811ad5909f155c14b943462c78beab3177b
-
SSDEEP
24576:KLl9Rl34Ma0PtBFoTz8J2gT1LwSlwiL45W96pt6TRU9/9Us:K59TTayuEZT1MS6i8J3R9j
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 4 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\df7691cde6502804fa2f7ceae1133136.exe"C:\Users\Admin\AppData\Local\Temp\df7691cde6502804fa2f7ceae1133136.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\df7691cde6502804fa2f7ceae1133136.exeC:\Users\Admin\AppData\Local\Temp\df7691cde6502804fa2f7ceae1133136.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.3MB
MD513d3ec49a9ff281c0c20b5a467c64ad9
SHA1253b4055fe571b58dbd6908ee672cb8d33d936b7
SHA2567edf8f68c9580b2b53479bb2953196e7271349ba8e429cb3bcdd50762426a932
SHA512eb687f23e0d059232c8c55b7392a0450671b7c592fd9f42ef4f2786e1b6783f3aa7c08648da28c7c7d8f11e5ad1782d45fb0e86e7ecf491f096e935341c128dd
-
Filesize
4.9MB
-
Filesize
2.1MB
-
Filesize
1.2MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
2.1MB
-
Filesize
1.2MB
-
Filesize
2.1MB
-
Filesize
4.9MB