Analysis
-
max time kernel
120s -
max time network
133s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
27/03/2024, 13:20
General
-
Target
e1c3b6720ad3987152b095751420a7e0.exe
-
Size
1.3MB
-
MD5
e1c3b6720ad3987152b095751420a7e0
-
SHA1
49b11f59dd407fc1127c6dd647555305b7874a2f
-
SHA256
08145540ca66ac439271ead365cd434316d9683bf4d4cd5d202446bc3e219f22
-
SHA512
028c3b199843d6cd6bf34fea1d2daac1b8926d61f2067dd382ca146bd95ba2a9c72b48989302bf95cd35aeb472cec027b96435705d327f22e0a942eb2ec4f71a
-
SSDEEP
24576:dXr3Rw42Np7yHzPRnDwUHrja/D3IzTaAZHGjGvq0lfgeQRRR5vRvG:xa4k7wzPRfK+NBGyLg/jLv
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e1c3b6720ad3987152b095751420a7e0.exe"C:\Users\Admin\AppData\Local\Temp\e1c3b6720ad3987152b095751420a7e0.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\e1c3b6720ad3987152b095751420a7e0.exeC:\Users\Admin\AppData\Local\Temp\e1c3b6720ad3987152b095751420a7e0.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.3MB
MD5f1db33100270bfd94d2949bc86f23afd
SHA1884fc584b69396a2844c43bff838b5e86be89f75
SHA2562a3e1f84cef4af2b71ab5ca32adcf82a55fd0ffe829ba3d62f457b94737df53e
SHA512697af81596c351363b12e99579fce397bc2b3389bc9c8c9b891217ccd2baed18e8b28eb97d2974a236da4710627531cebaddf4f997fb5512f9645738b832bb5a
-
Filesize
4.4MB
-
Filesize
1.9MB
-
Filesize
1.1MB
-
Filesize
4.4MB
-
Filesize
1.9MB
-
Filesize
4.4MB
-
Filesize
4.4MB
-
Filesize
1.1MB
-
Filesize
1.9MB
-
Filesize
4.4MB