ff66ab421e3865de1b88487bfdc28fe0be229371eb19b3c7100541878e2dabbc

Analysis

max time kernel
119s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
22/12/2023, 17:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fac9ebca0b28e2836fad67b1cc3d1baf.exe
Size

4.4MB
MD5

fac9ebca0b28e2836fad67b1cc3d1baf
SHA1

2c109ab045b131e94c1438f0fa2c54ac7a2dad9a
SHA256

ff66ab421e3865de1b88487bfdc28fe0be229371eb19b3c7100541878e2dabbc
SHA512

18a2e5d7632f8ed65247cebed4ceea3dd68b07daa040dc6aa5231bc6bd36c00ebe6a3ff7b413c79ba08cde64915dcdfc096f6b732086db40d050e3206904cf47
SSDEEP

98304:FN59LA3/4HBUCcqFp1HK3UT4NT4HBUCcg:FNPkAWC/f1q3ULWCX

Score

7^/10

upx

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1208	fac9ebca0b28e2836fad67b1cc3d1baf.exe

Executes dropped EXE 1 IoCs

pid	Process
1208	fac9ebca0b28e2836fad67b1cc3d1baf.exe

Loads dropped DLL 1 IoCs

pid	Process
2060	fac9ebca0b28e2836fad67b1cc3d1baf.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2060-0-0x0000000000400000-0x00000000008EF000-memory.dmp	upx
behavioral1/files/0x000c000000012327-10.dat	upx
behavioral1/files/0x000c000000012327-14.dat	upx
behavioral1/memory/2060-16-0x0000000003DA0000-0x000000000428F000-memory.dmp	upx

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2060	fac9ebca0b28e2836fad67b1cc3d1baf.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2060	fac9ebca0b28e2836fad67b1cc3d1baf.exe
1208	fac9ebca0b28e2836fad67b1cc3d1baf.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2060 wrote to memory of 1208	2060	fac9ebca0b28e2836fad67b1cc3d1baf.exe	28
PID 2060 wrote to memory of 1208	2060	fac9ebca0b28e2836fad67b1cc3d1baf.exe	28
PID 2060 wrote to memory of 1208	2060	fac9ebca0b28e2836fad67b1cc3d1baf.exe	28
PID 2060 wrote to memory of 1208	2060	fac9ebca0b28e2836fad67b1cc3d1baf.exe	28

C:\Users\Admin\AppData\Local\Temp\fac9ebca0b28e2836fad67b1cc3d1baf.exe
"C:\Users\Admin\AppData\Local\Temp\fac9ebca0b28e2836fad67b1cc3d1baf.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2060
- C:\Users\Admin\AppData\Local\Temp\fac9ebca0b28e2836fad67b1cc3d1baf.exe
  C:\Users\Admin\AppData\Local\Temp\fac9ebca0b28e2836fad67b1cc3d1baf.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:1208

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\fac9ebca0b28e2836fad67b1cc3d1baf.exe

Filesize
120KB

MD5
1f1d9c2594404b5fac5f7577da529d6f

SHA1
c92130d8efe17108114f29d7d575cf5109ff0f7f

SHA256
37033b4fbc14726fd24d514216c64b6044bc7864315177a52603db3f2d55aca7

SHA512
43dd98b36968cd33120fdb33547b5add22f01cd6222966a36f86a007ccc5db79ea4028d2190ec3907771ccffe86a89d6b9d3dec5f57129f69de08b5865da7cb3

Download Submit
\Users\Admin\AppData\Local\Temp\fac9ebca0b28e2836fad67b1cc3d1baf.exe

Filesize
307KB

MD5
4602b86083ec2ac89772b466beb29ebb

SHA1
e19e132362483f2ba30819508a37a299230a77fe

SHA256
8c04339dc34ae143b42bbb2dd2dbce1abdbbb6a0f438325661d5c8f2545338bf

SHA512
5ec072a851b27b65a035e8519e1df7c7f41c2c5df137465165c590c9e12d51de693121eba911bcfc457f167baa4edec96ace08b884387ed19fa7d63497e0c742

Download Submit
memory/1208-23-0x0000000000400000-0x000000000061D000-memory.dmp

Filesize
2.1MB

Download
memory/1208-15-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/1208-19-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/1208-21-0x00000000002B0000-0x00000000003E3000-memory.dmp

Filesize
1.2MB

Download
memory/1208-26-0x0000000003540000-0x000000000376A000-memory.dmp

Filesize
2.2MB

Download
memory/1208-32-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/2060-1-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/2060-2-0x00000000002C0000-0x00000000003F3000-memory.dmp

Filesize
1.2MB

Download
memory/2060-13-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/2060-16-0x0000000003DA0000-0x000000000428F000-memory.dmp

Filesize
4.9MB

Download
memory/2060-0-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/2060-31-0x0000000003DA0000-0x000000000428F000-memory.dmp

Filesize
4.9MB

Download