Analysis
-
max time kernel
117s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
27/03/2024, 00:30
General
-
Target
e056260086b0c90ccf597e3386946315.exe
-
Size
1.3MB
-
MD5
e056260086b0c90ccf597e3386946315
-
SHA1
bff8886d2369009bfb4731bfa1faae2c097fd953
-
SHA256
c3e81bba22c962d268f4a0abc9f99a547554df09a15d8572e74cd5bff329d373
-
SHA512
edba36ac8a627be0342dd5d4e0b22f29cabb59f94636b115fba3060f2c3b298946472cc6e24c78f8350ee8ae7da13fcc867aa31692c88a09d7c25c81f58aa0be
-
SSDEEP
24576:s3e77sIsbMrZyhy5hua5Dfr24PIDRutXNKBFPvO5SmvPJqkg/UecWc:s3eXqOZyhyj5Dj2iIDRcNKXvO5DJ8/UH
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e056260086b0c90ccf597e3386946315.exe"C:\Users\Admin\AppData\Local\Temp\e056260086b0c90ccf597e3386946315.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\e056260086b0c90ccf597e3386946315.exeC:\Users\Admin\AppData\Local\Temp\e056260086b0c90ccf597e3386946315.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.3MB
MD5df62d10ae250aae6003d1b2dd0dd4fa9
SHA1006f0c77f3cdd9c8a77faad34ad03864ee0d9502
SHA2562990e0d65a0e146c02887aad5b7ffcb1c0393100b65c55887181aa30734fc0b9
SHA5125d512b90f61ff0c705e2b3121b8426b82a51c2ed11958e86db472db1d2c3968ff97f5396d1f492bdc4a0702f3431294193aeb2a9143d96f816e68caf2ea7dddb
-
Filesize
4.9MB
-
Filesize
2.2MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
2.1MB
-
Filesize
2.2MB
-
Filesize
4.9MB