Analysis

  • max time kernel
    121s
  • max time network
    127s
  • platform
    windows7_x64
  • resource
    win7-20231023-en
  • resource tags

    arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
  • submitted
    01-12-2023 12:49

General

  • Target

    _RUNECE.vmp.exe

  • Size

    71.0MB

  • MD5

    4f82be843498084c59ebfdc9d3556d66

  • SHA1

    1dff2674a86c42e574083b712372d147982f8305

  • SHA256

    a614d740ca78216237022406c3b8df12dfe982d75d8973299d1ffa3a63974546

  • SHA512

    377797d21da768b148eeab03eeaabe809ede00fa9bf89b85362318bab8fc5ab98cfced4a6aef11e4f8edfb4382c9b0397c6a25a79d4d7630203bdd4d68184247

  • SSDEEP

    1572864:l2MerQqjqSk8IpG7V+VPhqCnE7R6u9jZS9uWdErnUEpiqY9PNdv:lZerdGSkB05awCmz91k2rn8pDdv

Score
7/10
upx

Malware Config

Signatures

  • Loads dropped DLL 1 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\_RUNECE.vmp.exe
    "C:\Users\Admin\AppData\Local\Temp\_RUNECE.vmp.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3036
    • C:\Users\Admin\AppData\Local\Temp\_RUNECE.vmp.exe
      "C:\Users\Admin\AppData\Local\Temp\_RUNECE.vmp.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious behavior: GetForegroundWindowSpam
      PID:2364

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\_MEI30362\python39.dll

    Filesize

    1.4MB

    MD5

    2dcee515eef346a7c77d2e6d37e6d761

    SHA1

    9daecbcbb7d599ad5167dfa21c719b3eb72f9c3c

    SHA256

    610a12bccc3545376ae42ee74be12d5481ab35ec7cca01cb02a8e95e2793a2e5

    SHA512

    d9d89b9a83312f53db69d351054a226146135200eb88e9e69227a953d844cb26af9546baf54da83aa744c91304ba1c8ba077b78096a0a4ac12cce1ee6b8ba6f2

  • C:\Users\Admin\AppData\Local\Temp\_MEI30362\setuptools-49.2.1.dist-info\INSTALLER

    Filesize

    4B

    MD5

    365c9bfeb7d89244f2ce01c1de44cb85

    SHA1

    d7a03141d5d6b1e88b6b59ef08b6681df212c599

    SHA256

    ceebae7b8927a3227e5303cf5e0f1f7b34bb542ad7250ac03fbcde36ec2f1508

    SHA512

    d220d322a4053d84130567d626a9f7bb2fb8f0b854da1621f001826dc61b0ed6d3f91793627e6f0ac2ac27aea2b986b6a7a63427f05fe004d8a2adfbdadc13c1

  • \Users\Admin\AppData\Local\Temp\_MEI30362\python39.dll

    Filesize

    1.4MB

    MD5

    2dcee515eef346a7c77d2e6d37e6d761

    SHA1

    9daecbcbb7d599ad5167dfa21c719b3eb72f9c3c

    SHA256

    610a12bccc3545376ae42ee74be12d5481ab35ec7cca01cb02a8e95e2793a2e5

    SHA512

    d9d89b9a83312f53db69d351054a226146135200eb88e9e69227a953d844cb26af9546baf54da83aa744c91304ba1c8ba077b78096a0a4ac12cce1ee6b8ba6f2

  • memory/2364-1262-0x000007FEF5C20000-0x000007FEF609F000-memory.dmp

    Filesize

    4.5MB

  • memory/2364-1263-0x000007FEF5C20000-0x000007FEF609F000-memory.dmp

    Filesize

    4.5MB