Analysis
-
max time kernel
117s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
-
submitted
15/07/2024, 09:25
General
-
Target
ba9a6f354e9e8f5be652a5bc10e6af60N.exe
-
Size
59KB
-
MD5
ba9a6f354e9e8f5be652a5bc10e6af60
-
SHA1
079bb11b606fe93d8343b00293bd809b15694ac1
-
SHA256
fd588a4df87618f3822bd4f7f60e58cf97a8b75a8eaabe8668406ace5cbaf0f2
-
SHA512
99122c1b5f28e90bb1ee1a5a0ead4607fefdffe6cd34e02adf9bbda17cc0a783c005a09a7a104fd649c0269db321ca7b3bde4e315193db4cc3d2f4987d62baa4
-
SSDEEP
1536:Zcp13tH9T/O5+L2FC2NB3dwvkP0HJt9QVTsMCe4K4ky:Zi9tH9T/O5+4C2N1dwvkP8t+Tu
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ba9a6f354e9e8f5be652a5bc10e6af60N.exe"C:\Users\Admin\AppData\Local\Temp\ba9a6f354e9e8f5be652a5bc10e6af60N.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ba9a6f354e9e8f5be652a5bc10e6af60N.exeC:\Users\Admin\AppData\Local\Temp\ba9a6f354e9e8f5be652a5bc10e6af60N.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
59KB
MD596be5610f8e3ac33f39b2b154d74cced
SHA1a288ef0fac58c4bd78a039c52dab6679f7f8d014
SHA2561b45bde9c900687af26e6ea2e68660135f2aa524919bfc043b4fa0ed4c0ee465
SHA5127dab3b5a327a4651711480e7e7d840a4549d3609e4ca8889554cb97cfe8d0a1f1dcd74c94b939128c5dbf9ad8b21dd80f36903445776617763ae6b0de08e9931
-
Filesize
244KB
-
Filesize
56KB
-
Filesize
116KB
-
Filesize
60KB
-
Filesize
116KB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
60KB
-
Filesize
116KB
-
Filesize
116KB