9ca7d6785a7bc7764c293f877d33a2dc80fd09d3f56dc749bfe8d408df0a0ed8

Analysis

max time kernel
22s
max time network
33s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
01/12/2022, 09:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

9ca7d6785a7bc7764c293f877d33a2dc80fd09d3f56dc749bfe8d408df0a0ed8.exe
Size

97KB
MD5

7e1aa1df2e5ccd3914e86e66b7994072
SHA1

a6e7b3cbd9145f85d9bd0040ed6422faa4d3d6ff
SHA256

9ca7d6785a7bc7764c293f877d33a2dc80fd09d3f56dc749bfe8d408df0a0ed8
SHA512

28019d29aebaed7067f19f5cbad0472347e3cff96dab8de7132f1334f14fbe3287cc5bb80559ecca80c6f71b33a0bb4d0e06815d4e445c75669ee5531b1e0d13
SSDEEP

3072:JgYHo5lle7x+eprnpY3qnh4O2pjoNtOSBe:aocQnpdh45wt7e

Score

8^/10

upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
892	realplay.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/892-60-0x0000000000310000-0x0000000000396000-memory.dmp	upx
behavioral1/memory/1680-61-0x0000000000400000-0x0000000000486000-memory.dmp	upx

Loads dropped DLL 2 IoCs

pid	Process
1680	9ca7d6785a7bc7764c293f877d33a2dc80fd09d3f56dc749bfe8d408df0a0ed8.exe
1680	9ca7d6785a7bc7764c293f877d33a2dc80fd09d3f56dc749bfe8d408df0a0ed8.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\realplay.exe	9ca7d6785a7bc7764c293f877d33a2dc80fd09d3f56dc749bfe8d408df0a0ed8.exe
File opened for modification	C:\Windows\SysWOW64\realplay.exe	9ca7d6785a7bc7764c293f877d33a2dc80fd09d3f56dc749bfe8d408df0a0ed8.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1680 wrote to memory of 892	1680	9ca7d6785a7bc7764c293f877d33a2dc80fd09d3f56dc749bfe8d408df0a0ed8.exe	28
PID 1680 wrote to memory of 892	1680	9ca7d6785a7bc7764c293f877d33a2dc80fd09d3f56dc749bfe8d408df0a0ed8.exe	28
PID 1680 wrote to memory of 892	1680	9ca7d6785a7bc7764c293f877d33a2dc80fd09d3f56dc749bfe8d408df0a0ed8.exe	28
PID 1680 wrote to memory of 892	1680	9ca7d6785a7bc7764c293f877d33a2dc80fd09d3f56dc749bfe8d408df0a0ed8.exe	28

C:\Users\Admin\AppData\Local\Temp\9ca7d6785a7bc7764c293f877d33a2dc80fd09d3f56dc749bfe8d408df0a0ed8.exe
"C:\Users\Admin\AppData\Local\Temp\9ca7d6785a7bc7764c293f877d33a2dc80fd09d3f56dc749bfe8d408df0a0ed8.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1680
- C:\Windows\SysWOW64\realplay.exe
  C:\Windows\system32\realplay.exe 536 "C:\Users\Admin\AppData\Local\Temp\9ca7d6785a7bc7764c293f877d33a2dc80fd09d3f56dc749bfe8d408df0a0ed8.exe"
  2⤵
  - Executes dropped EXE
  PID:892

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\realplay.exe

Filesize
97KB

MD5
7e1aa1df2e5ccd3914e86e66b7994072

SHA1
a6e7b3cbd9145f85d9bd0040ed6422faa4d3d6ff

SHA256
9ca7d6785a7bc7764c293f877d33a2dc80fd09d3f56dc749bfe8d408df0a0ed8

SHA512
28019d29aebaed7067f19f5cbad0472347e3cff96dab8de7132f1334f14fbe3287cc5bb80559ecca80c6f71b33a0bb4d0e06815d4e445c75669ee5531b1e0d13

Download Submit
\Windows\SysWOW64\realplay.exe

Filesize
97KB

MD5
7e1aa1df2e5ccd3914e86e66b7994072

SHA1
a6e7b3cbd9145f85d9bd0040ed6422faa4d3d6ff

SHA256
9ca7d6785a7bc7764c293f877d33a2dc80fd09d3f56dc749bfe8d408df0a0ed8

SHA512
28019d29aebaed7067f19f5cbad0472347e3cff96dab8de7132f1334f14fbe3287cc5bb80559ecca80c6f71b33a0bb4d0e06815d4e445c75669ee5531b1e0d13

Download Submit
\Windows\SysWOW64\realplay.exe

Filesize
97KB

MD5
7e1aa1df2e5ccd3914e86e66b7994072

SHA1
a6e7b3cbd9145f85d9bd0040ed6422faa4d3d6ff

SHA256
9ca7d6785a7bc7764c293f877d33a2dc80fd09d3f56dc749bfe8d408df0a0ed8

SHA512
28019d29aebaed7067f19f5cbad0472347e3cff96dab8de7132f1334f14fbe3287cc5bb80559ecca80c6f71b33a0bb4d0e06815d4e445c75669ee5531b1e0d13

Download Submit
memory/892-59-0x0000000000590000-0x0000000000618000-memory.dmp

Filesize
544KB

Download
memory/892-60-0x0000000000310000-0x0000000000396000-memory.dmp

Filesize
536KB

Download
memory/1680-54-0x0000000074D81000-0x0000000074D83000-memory.dmp

Filesize
8KB

Download
memory/1680-61-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/1680-62-0x00000000008C0000-0x0000000000948000-memory.dmp

Filesize
544KB

Download