dcc2eba151e94d461437dc564983810c6204f8475bf987e6fe4b92d0b9600607

Analysis

max time kernel
118s
max time network
129s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
22-12-2023 15:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e32d48369bdeec7f5047ef0891bf9189.exe
Size

266KB
MD5

e32d48369bdeec7f5047ef0891bf9189
SHA1

89632ae5fd5a8ba94f8c03d0a433f4b1e02e820c
SHA256

dcc2eba151e94d461437dc564983810c6204f8475bf987e6fe4b92d0b9600607
SHA512

3fe2ecbc65f994b72dfcdb17ecf265bbe660e157f1bada23c99920f074e3fd72a79d51cb53f72556ec85a066826d5215a431b12d3bbae9627f124410d61d3208
SSDEEP

6144:t7sVlEa1kSBjJtBNvjAM8TvypKd1KtA5qQnqccYlofBO/ypQ:t7sgalBppjAZCtAsHD5O9

Score

7^/10

upx

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2684	e32d48369bdeec7f5047ef0891bf9189.exe

Executes dropped EXE 1 IoCs

pid	Process
2684	e32d48369bdeec7f5047ef0891bf9189.exe

Loads dropped DLL 1 IoCs

pid	Process
2536	e32d48369bdeec7f5047ef0891bf9189.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2536-0-0x0000000000400000-0x0000000000486000-memory.dmp	upx
behavioral1/files/0x000a000000012261-11.dat	upx
behavioral1/memory/2684-17-0x0000000000400000-0x0000000000486000-memory.dmp	upx

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2536	e32d48369bdeec7f5047ef0891bf9189.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2536	e32d48369bdeec7f5047ef0891bf9189.exe
2684	e32d48369bdeec7f5047ef0891bf9189.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2536 wrote to memory of 2684	2536	e32d48369bdeec7f5047ef0891bf9189.exe	29
PID 2536 wrote to memory of 2684	2536	e32d48369bdeec7f5047ef0891bf9189.exe	29
PID 2536 wrote to memory of 2684	2536	e32d48369bdeec7f5047ef0891bf9189.exe	29
PID 2536 wrote to memory of 2684	2536	e32d48369bdeec7f5047ef0891bf9189.exe	29

C:\Users\Admin\AppData\Local\Temp\e32d48369bdeec7f5047ef0891bf9189.exe
"C:\Users\Admin\AppData\Local\Temp\e32d48369bdeec7f5047ef0891bf9189.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2536
- C:\Users\Admin\AppData\Local\Temp\e32d48369bdeec7f5047ef0891bf9189.exe
  C:\Users\Admin\AppData\Local\Temp\e32d48369bdeec7f5047ef0891bf9189.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:2684

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\CabDF69.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
\Users\Admin\AppData\Local\Temp\e32d48369bdeec7f5047ef0891bf9189.exe

Filesize
266KB

MD5
ec2c0331bbea0e8424f193859628339f

SHA1
e34b902861ff2293caab40953e79464e511eb389

SHA256
f0ca7df76f87b3cd8487af4fc914ea2fecdf781ae9595fa3499324c3a3169e73

SHA512
fd01b9462d20d5f93cf991566fd301edcfd01b738abadc6aa4a0f6361e4372c42c4dbd3bc6b3e95cfafc57c4a5d409b2d02989adcead8dcd083fe3f57ba63b89

Download Submit
memory/2536-0-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/2536-1-0x00000000001F0000-0x0000000000211000-memory.dmp

Filesize
132KB

Download
memory/2536-2-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2536-15-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2536-14-0x0000000001490000-0x0000000001516000-memory.dmp

Filesize
536KB

Download
memory/2684-17-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/2684-18-0x00000000002D0000-0x00000000002F1000-memory.dmp

Filesize
132KB

Download
memory/2684-25-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download