dd0953c2267700112fae78863569a4366d20ca224318b55c01671d3f61a85cbc

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 07:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0fa3ece3df887c2e7521c3569fb259fe.exe
Size

115KB
MD5

0fa3ece3df887c2e7521c3569fb259fe
SHA1

83f8349df71209107fb00003e599d391f6eba600
SHA256

dd0953c2267700112fae78863569a4366d20ca224318b55c01671d3f61a85cbc
SHA512

c24cbc6f5b073a400519d193de48035d50f8d1f94ba27fa593ccc9f2dd5dc2c25764dc77578f84ec275ee70a57501cec13cce6c6989b4347e846ba047c6887c2
SSDEEP

3072:DGgTPMbRq/xn0XOD2AbG4s5i35gBQr9kxQHj+wOX+9f:DdTaNAbGx5QgyrSxQDQu9f

Score

7^/10

upx

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1824	0fa3ece3df887c2e7521c3569fb259fe.exe

Executes dropped EXE 1 IoCs

pid	Process
1824	0fa3ece3df887c2e7521c3569fb259fe.exe

Loads dropped DLL 1 IoCs

pid	Process
3044	0fa3ece3df887c2e7521c3569fb259fe.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/3044-0-0x0000000000400000-0x0000000000475000-memory.dmp	upx
behavioral1/files/0x000a00000001225c-11.dat	upx
behavioral1/files/0x000a00000001225c-15.dat	upx

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3044	0fa3ece3df887c2e7521c3569fb259fe.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
3044	0fa3ece3df887c2e7521c3569fb259fe.exe
1824	0fa3ece3df887c2e7521c3569fb259fe.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3044 wrote to memory of 1824	3044	0fa3ece3df887c2e7521c3569fb259fe.exe	16
PID 3044 wrote to memory of 1824	3044	0fa3ece3df887c2e7521c3569fb259fe.exe	16
PID 3044 wrote to memory of 1824	3044	0fa3ece3df887c2e7521c3569fb259fe.exe	16
PID 3044 wrote to memory of 1824	3044	0fa3ece3df887c2e7521c3569fb259fe.exe	16

C:\Users\Admin\AppData\Local\Temp\0fa3ece3df887c2e7521c3569fb259fe.exe
C:\Users\Admin\AppData\Local\Temp\0fa3ece3df887c2e7521c3569fb259fe.exe
1⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
PID:1824

C:\Users\Admin\AppData\Local\Temp\0fa3ece3df887c2e7521c3569fb259fe.exe
"C:\Users\Admin\AppData\Local\Temp\0fa3ece3df887c2e7521c3569fb259fe.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3044

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\0fa3ece3df887c2e7521c3569fb259fe.exe

Filesize
115KB

MD5
afdcff45c5f3320816806d490660089a

SHA1
213b5f26333aad6c7fb44f3192a46d0641659cce

SHA256
5da81f0bc657178c5d8deb37b3ca3d18b1213bc61d6414ecf5d1b121432523e8

SHA512
040a12b6b3ab8cfb6f929cd54d7d01daaa71fa59095dfb410c14cf3852df4bd5a4e0cd8310264451752a12f8e7f7864d0207f6f586021425b06f6745144f1673

Download Submit
\Users\Admin\AppData\Local\Temp\0fa3ece3df887c2e7521c3569fb259fe.exe

Filesize
92KB

MD5
9daf3ed8ce19dcaf273dccf9623f21a0

SHA1
d7e8ac92935a8ce41b8421a209f5f1c71f5095ee

SHA256
253a9c1f17fc94289535d14069a48801c346e148b3960c8216025c6c91889eb0

SHA512
0e300dd9b46cdabd510ee11790bfd9c5777203f6d298b847781847703db75af1a4801f251580049b96c2b4ac599f1f921568129446674b567ec461d1edb97adf

Download Submit
memory/1824-19-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1824-31-0x0000000000170000-0x000000000018D000-memory.dmp

Filesize
116KB

Download
memory/1824-26-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/1824-21-0x0000000000140000-0x000000000015D000-memory.dmp

Filesize
116KB

Download
memory/1824-32-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3044-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3044-2-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/3044-1-0x00000000001D0000-0x00000000001ED000-memory.dmp

Filesize
116KB

Download
memory/3044-17-0x0000000000330000-0x00000000003A5000-memory.dmp

Filesize
468KB

Download
memory/3044-16-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download