eb3ba5b43795700702e5b2e1f7178488d8f7e2ba88bb140eac072e5bb2a1bbc8

Analysis

max time kernel
118s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
22-12-2023 14:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bc0c01169cdcc557412540433495ce56.exe
Size

9.1MB
MD5

bc0c01169cdcc557412540433495ce56
SHA1

94df06a88da0f218121021afdc42c49df87ef57b
SHA256

eb3ba5b43795700702e5b2e1f7178488d8f7e2ba88bb140eac072e5bb2a1bbc8
SHA512

f59194228b882ddb833d74b518d2eb0494fe6bc7878bb7a35d5ea8bb08ef31f24425c5e90f323f07678831b62f1ff7e62368f0316e79b6cd923563e7c952ba6d
SSDEEP

196608:kAc1cumHgl/iBmEflzMpgl/iBK/e0Kst7m0gl/iBmEflzMpgl/iB0:kAc8H2i3G2iNs602i3G2i0

Score

7^/10

upx

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2448	bc0c01169cdcc557412540433495ce56.exe

Executes dropped EXE 1 IoCs

pid	Process
2448	bc0c01169cdcc557412540433495ce56.exe

Loads dropped DLL 1 IoCs

pid	Process
2512	bc0c01169cdcc557412540433495ce56.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2512-0-0x0000000000400000-0x00000000008EF000-memory.dmp	upx
behavioral1/files/0x000a000000012243-15.dat	upx
behavioral1/memory/2448-18-0x0000000000400000-0x00000000008EF000-memory.dmp	upx
behavioral1/memory/2512-13-0x0000000004450000-0x000000000493F000-memory.dmp	upx
behavioral1/files/0x000a000000012243-10.dat	upx

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2512	bc0c01169cdcc557412540433495ce56.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2512	bc0c01169cdcc557412540433495ce56.exe
2448	bc0c01169cdcc557412540433495ce56.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2512 wrote to memory of 2448	2512	bc0c01169cdcc557412540433495ce56.exe	28
PID 2512 wrote to memory of 2448	2512	bc0c01169cdcc557412540433495ce56.exe	28
PID 2512 wrote to memory of 2448	2512	bc0c01169cdcc557412540433495ce56.exe	28
PID 2512 wrote to memory of 2448	2512	bc0c01169cdcc557412540433495ce56.exe	28

C:\Users\Admin\AppData\Local\Temp\bc0c01169cdcc557412540433495ce56.exe
"C:\Users\Admin\AppData\Local\Temp\bc0c01169cdcc557412540433495ce56.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2512
- C:\Users\Admin\AppData\Local\Temp\bc0c01169cdcc557412540433495ce56.exe
  C:\Users\Admin\AppData\Local\Temp\bc0c01169cdcc557412540433495ce56.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:2448

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\bc0c01169cdcc557412540433495ce56.exe

Filesize
206KB

MD5
5c90aa3a18f131b5b76fb29dfeec4bed

SHA1
52bde960a79adb5b87ee2633cf8c89d85cc180e8

SHA256
3242b7ff4b00e7b2d0b48ab75cb00b570f01d10d1c1ac99fea53ea56936c63e1

SHA512
7c292acabb93670f8d7f6a980b3e1c067d0b148ca9bf5e976abf2c7e66b2b74406b9ec938de99efc788e431bdda84a106bca03f9b22f15d78161e4f7266dba51

Download Submit
\Users\Admin\AppData\Local\Temp\bc0c01169cdcc557412540433495ce56.exe

Filesize
590KB

MD5
9abbb0913e9e0ea7ef3561e8a7a4d83d

SHA1
127471232885b6f906d514cbf1c2f0b3841a4423

SHA256
9e11232dfa7224ed1e56b4d6d960a163edb532508f722806e01260d874bc26de

SHA512
c3c761cd4903a4bef3270f27e36c810bbaea12377dc3cc42ed9225ca7211bd8ba05052fdbce74e7a20a68803c401f60da331b9d53a204c6e1268a4c506883699

Download Submit
memory/2448-16-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/2448-18-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/2448-20-0x0000000001B20000-0x0000000001C53000-memory.dmp

Filesize
1.2MB

Download
memory/2448-23-0x0000000000400000-0x000000000061D000-memory.dmp

Filesize
2.1MB

Download
memory/2448-25-0x0000000003410000-0x000000000363A000-memory.dmp

Filesize
2.2MB

Download
memory/2448-32-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/2512-14-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/2512-1-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/2512-0-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/2512-13-0x0000000004450000-0x000000000493F000-memory.dmp

Filesize
4.9MB

Download
memory/2512-2-0x0000000001B20000-0x0000000001C53000-memory.dmp

Filesize
1.2MB

Download
memory/2512-31-0x0000000004450000-0x000000000493F000-memory.dmp

Filesize
4.9MB

Download