94843bc4ff5cb085cfa6a69b32e83a33dea5ed4a8a9965e594decbf3dc57a448

Analysis

max time kernel
119s
max time network
148s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
22/12/2023, 14:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b8f00080caadadecb6d4b0bd145897c4.exe
Size

5.3MB
MD5

b8f00080caadadecb6d4b0bd145897c4
SHA1

fd0bd930feb73eac764a14fef84dc1b08026922c
SHA256

94843bc4ff5cb085cfa6a69b32e83a33dea5ed4a8a9965e594decbf3dc57a448
SHA512

71f8d1a86c0ceb1f1ca69c629c33a3f11d20ed8632f30ebf07d9f0890f92584e5151ae0cc8ac32a9a5f2d4051eda9f15c13b4fbb9c709ee2a6ba2448180d2750
SSDEEP

98304:mmtZOgqt5sFdKcqlC92IZ1Q8tfYxOsTBWGMCE2IZ1Q8tfY:mmCBwyM9pZdwjW/HpZdw

Score

7^/10

upx

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2696	b8f00080caadadecb6d4b0bd145897c4.exe

Executes dropped EXE 1 IoCs

pid	Process
2696	b8f00080caadadecb6d4b0bd145897c4.exe

Loads dropped DLL 1 IoCs

pid	Process
3056	b8f00080caadadecb6d4b0bd145897c4.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/3056-0-0x0000000000400000-0x000000000086A000-memory.dmp	upx
behavioral1/files/0x000b000000012255-11.dat	upx
behavioral1/files/0x000b000000012255-14.dat	upx

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3056	b8f00080caadadecb6d4b0bd145897c4.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
3056	b8f00080caadadecb6d4b0bd145897c4.exe
2696	b8f00080caadadecb6d4b0bd145897c4.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3056 wrote to memory of 2696	3056	b8f00080caadadecb6d4b0bd145897c4.exe	27
PID 3056 wrote to memory of 2696	3056	b8f00080caadadecb6d4b0bd145897c4.exe	27
PID 3056 wrote to memory of 2696	3056	b8f00080caadadecb6d4b0bd145897c4.exe	27
PID 3056 wrote to memory of 2696	3056	b8f00080caadadecb6d4b0bd145897c4.exe	27

C:\Users\Admin\AppData\Local\Temp\b8f00080caadadecb6d4b0bd145897c4.exe
"C:\Users\Admin\AppData\Local\Temp\b8f00080caadadecb6d4b0bd145897c4.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3056
- C:\Users\Admin\AppData\Local\Temp\b8f00080caadadecb6d4b0bd145897c4.exe
  C:\Users\Admin\AppData\Local\Temp\b8f00080caadadecb6d4b0bd145897c4.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:2696

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\b8f00080caadadecb6d4b0bd145897c4.exe

Filesize
2.0MB

MD5
91f6c42b769a364349b5f200e4e2147c

SHA1
e2d7ec36dc47e7c7d1214e420a55dd77fba46c3c

SHA256
a862d6c04676c4892668e876d2ed64a797a54f145cd34e01cb1a40fbdc1e0250

SHA512
7eaddad942fbfd527f712dd8b5513e7e19858ace180ae0bb3f8ff1f44592f7879b0b2e2376687f979875b0a137f912f87ee2c49f7ffa81bdf080ee35382fe7ee

Download Submit
\Users\Admin\AppData\Local\Temp\b8f00080caadadecb6d4b0bd145897c4.exe

Filesize
2.1MB

MD5
a13931ee9a3751ee3f57e1c69e945718

SHA1
ac5a8cd38cb26a84fc776ab3002f2239bfa1617e

SHA256
2941d6e11d3eeb4db4c6521f6d8258c5d480c641afcae809be7be28b4b6f7504

SHA512
05aec3a4eaeebd18908c4b61be56cbb82069a783ada04ebffc0464f620bdb04bf9610e7d110d8cfc0162c2768362012c5435e757b17efa0f7a67e360b0048907

Download Submit
memory/2696-17-0x0000000000400000-0x00000000005F2000-memory.dmp

Filesize
1.9MB

Download
memory/2696-18-0x0000000000130000-0x0000000000242000-memory.dmp

Filesize
1.1MB

Download
memory/2696-20-0x0000000000400000-0x000000000086A000-memory.dmp

Filesize
4.4MB

Download
memory/2696-27-0x0000000000400000-0x000000000086A000-memory.dmp

Filesize
4.4MB

Download
memory/3056-0-0x0000000000400000-0x000000000086A000-memory.dmp

Filesize
4.4MB

Download
memory/3056-2-0x0000000001A60000-0x0000000001B72000-memory.dmp

Filesize
1.1MB

Download
memory/3056-1-0x0000000000400000-0x00000000005F2000-memory.dmp

Filesize
1.9MB

Download
memory/3056-16-0x0000000003D80000-0x00000000041EA000-memory.dmp

Filesize
4.4MB

Download
memory/3056-15-0x0000000000400000-0x00000000005F2000-memory.dmp

Filesize
1.9MB

Download
memory/3056-26-0x0000000003D80000-0x00000000041EA000-memory.dmp

Filesize
4.4MB

Download