8205d3aa8812497bf8a5c43c4b5a10465b5519f9d52768f214ca3d61a9158a2c

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
22/12/2023, 14:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b8ea985eac7f117a0744bffb56740de6.exe
Size

1.3MB
MD5

b8ea985eac7f117a0744bffb56740de6
SHA1

f53f4c3e052c77a9ed7bf5d0c7bd6ce54a6b5a9e
SHA256

8205d3aa8812497bf8a5c43c4b5a10465b5519f9d52768f214ca3d61a9158a2c
SHA512

7eb13cc98bcb2aebd44c684de098fffc69e15c6fdbdcc83efd62a577b947af8c1e2c1b6d49083ac5932e60c24a9b0322fb0571e7d7659370d2540f8d0de4d074
SSDEEP

24576:ZdDvOMjIGk0rSS5r/6HiFvKvRbY0ShonUstDgyItRvG:jT5jIGpfNyiFv0M9+Us53k

Score

7^/10

upx

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1048	b8ea985eac7f117a0744bffb56740de6.exe

Executes dropped EXE 1 IoCs

pid	Process
1048	b8ea985eac7f117a0744bffb56740de6.exe

Loads dropped DLL 1 IoCs

pid	Process
2916	b8ea985eac7f117a0744bffb56740de6.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2916-1-0x0000000000400000-0x000000000086A000-memory.dmp	upx
behavioral1/files/0x000c0000000122c4-11.dat	upx
behavioral1/files/0x000c0000000122c4-16.dat	upx
behavioral1/memory/1048-17-0x0000000000400000-0x000000000086A000-memory.dmp	upx

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2916	b8ea985eac7f117a0744bffb56740de6.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2916	b8ea985eac7f117a0744bffb56740de6.exe
1048	b8ea985eac7f117a0744bffb56740de6.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2916 wrote to memory of 1048	2916	b8ea985eac7f117a0744bffb56740de6.exe	25
PID 2916 wrote to memory of 1048	2916	b8ea985eac7f117a0744bffb56740de6.exe	25
PID 2916 wrote to memory of 1048	2916	b8ea985eac7f117a0744bffb56740de6.exe	25
PID 2916 wrote to memory of 1048	2916	b8ea985eac7f117a0744bffb56740de6.exe	25

C:\Users\Admin\AppData\Local\Temp\b8ea985eac7f117a0744bffb56740de6.exe
"C:\Users\Admin\AppData\Local\Temp\b8ea985eac7f117a0744bffb56740de6.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2916
- C:\Users\Admin\AppData\Local\Temp\b8ea985eac7f117a0744bffb56740de6.exe
  C:\Users\Admin\AppData\Local\Temp\b8ea985eac7f117a0744bffb56740de6.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:1048

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\b8ea985eac7f117a0744bffb56740de6.exe

Filesize
1KB

MD5
25dc01d37eeb42b4e0a37de2b1446904

SHA1
d004cab27ff1d09a9b9169ed11b2806e5659714d

SHA256
e0aa34b1fc4d5dbf34d71d3e94e76eb4f6ff71b86a69fecec64708e65b0f34da

SHA512
d6893dd48c50c39112edc770a49c51aaf5b194ecdc2786cf6f31e87ea20cfef41534cfd89422a8fb82ab8ea6ea00a09a28640a7428f00b74d85af267fc03a23f

Download Submit
\Users\Admin\AppData\Local\Temp\b8ea985eac7f117a0744bffb56740de6.exe

Filesize
2KB

MD5
2a69997bac4f69ae70f7ff0706c98232

SHA1
8c89af7a9302b895666bd615329a0a372886df41

SHA256
4173503202eac0618c0449cd8800e7d9b9802967fa02e66bf138eaa025584c74

SHA512
6b230fa3bf123c4085e89660b7713dbea60577760b43c8f74724c099245d1be32124be0e8f8ea8842769e27f61aab09f0646f464992b68e771a06f55b939e30c

Download Submit
memory/1048-17-0x0000000000400000-0x000000000086A000-memory.dmp

Filesize
4.4MB

Download
memory/1048-19-0x0000000000230000-0x0000000000342000-memory.dmp

Filesize
1.1MB

Download
memory/1048-18-0x0000000000400000-0x00000000005F2000-memory.dmp

Filesize
1.9MB

Download
memory/1048-27-0x0000000000400000-0x000000000086A000-memory.dmp

Filesize
4.4MB

Download
memory/2916-1-0x0000000000400000-0x000000000086A000-memory.dmp

Filesize
4.4MB

Download
memory/2916-3-0x0000000000260000-0x0000000000372000-memory.dmp

Filesize
1.1MB

Download
memory/2916-0-0x0000000000400000-0x00000000005F2000-memory.dmp

Filesize
1.9MB

Download
memory/2916-15-0x0000000003680000-0x0000000003AEA000-memory.dmp

Filesize
4.4MB

Download
memory/2916-14-0x0000000000400000-0x00000000005F2000-memory.dmp

Filesize
1.9MB

Download
memory/2916-26-0x0000000003680000-0x0000000003AEA000-memory.dmp

Filesize
4.4MB

Download