e4852aad5c54e48f680657770df676ed4e2deddf18e065738c22408afcd8f9ad

Resubmissions

09/10/2023, 19:45

231009-ygnm9aaa82 10

09/10/2023, 19:13

09/10/2023, 19:09

08/10/2023, 22:57

08/10/2023, 17:47

08/10/2023, 17:43

08/10/2023, 17:24

08/10/2023, 15:14

Analysis

max time kernel
26s
max time network
19s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
08/10/2023, 17:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

A92.exe
Size

75.8MB
MD5

4fb2d72821abf6062c52dd5c647e86bb
SHA1

91af4276217071500af264d4c0d7622025f4951c
SHA256

e4852aad5c54e48f680657770df676ed4e2deddf18e065738c22408afcd8f9ad
SHA512

fa970bff2cb5cc6e8fceb80607b89447bbd929886e3495c180ddc10a38a585d54f89f2c06556b0f1d77dd0aae80f88f6398d9043710e540726f68513e3bb5348
SSDEEP

1572864:W2MTiQYH6Sk8IpG7V+VPhqC3/E7lftCHpXnnYWlXxTa9k4VjkWraUrB6QYdv:WZTixaSkB05awC3RJX33Ty9VjkKaUrcn

Score

7^/10

upx

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
2896	A92.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000400000001cc4f-1247.dat	upx
behavioral1/files/0x000400000001cc4f-1248.dat	upx
behavioral1/memory/2896-1249-0x000007FEF5790000-0x000007FEF5D7A000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2888 wrote to memory of 2896	2888	A92.exe	28
PID 2888 wrote to memory of 2896	2888	A92.exe	28
PID 2888 wrote to memory of 2896	2888	A92.exe	28

C:\Users\Admin\AppData\Local\Temp\A92.exe
"C:\Users\Admin\AppData\Local\Temp\A92.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2888
- C:\Users\Admin\AppData\Local\Temp\A92.exe
  "C:\Users\Admin\AppData\Local\Temp\A92.exe"
  2⤵
  - Loads dropped DLL
  PID:2896

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_MEI28882\python311.dll

Filesize
1.6MB

MD5
1e76961ca11f929e4213fca8272d0194

SHA1
e52763b7ba970c3b14554065f8c2404112f53596

SHA256
8a0c27f9e5b2efd54e41d7e7067d7cb1c6d23bae5229f6d750f89568566227b0

SHA512
ec6ed913e0142a98cd7f6adced5671334ec6545e583284ae10627162b199e55867d7cf28efeaadce9862c978b01c234a850288e529d2d3e2ac7dbbb99c6cde9b

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI28882\python311.dll

Filesize
1.6MB

MD5
1e76961ca11f929e4213fca8272d0194

SHA1
e52763b7ba970c3b14554065f8c2404112f53596

SHA256
8a0c27f9e5b2efd54e41d7e7067d7cb1c6d23bae5229f6d750f89568566227b0

SHA512
ec6ed913e0142a98cd7f6adced5671334ec6545e583284ae10627162b199e55867d7cf28efeaadce9862c978b01c234a850288e529d2d3e2ac7dbbb99c6cde9b

Download Submit
memory/2896-1249-0x000007FEF5790000-0x000007FEF5D7A000-memory.dmp

Filesize
5.9MB

Download
memory/2896-1250-0x000007FEF5790000-0x000007FEF5D7A000-memory.dmp

Filesize
5.9MB

Download