af4c978866cf95e52785033bbf6f1ca6fb6237ef00cc67308c8b15d2fbfd9a64

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 11:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

19eb8274ae63acfa1be3c2ebe064d134.exe
Size

1.3MB
MD5

19eb8274ae63acfa1be3c2ebe064d134
SHA1

be091273b014c2cd2abe030a31640cbaf16c84ec
SHA256

af4c978866cf95e52785033bbf6f1ca6fb6237ef00cc67308c8b15d2fbfd9a64
SHA512

0057bd2098ad6f84dbaa6b0d1661c20b4224f8dfb927c6d0338d9821750120688525409ed6f00c90e3c5b0691d54453fea59ffaff4ec313645f5ade0f58c0f94
SSDEEP

24576:aca5eED/O+afxwvUSeRRJS/R34AvyGh1GnKyHRAdOY4bqRLvG:aHME0wUrUmAaGvQKkRAdT4G

Score

7^/10

upx

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3024	19eb8274ae63acfa1be3c2ebe064d134.exe

Executes dropped EXE 1 IoCs

pid	Process
3024	19eb8274ae63acfa1be3c2ebe064d134.exe

Loads dropped DLL 1 IoCs

pid	Process
2908	19eb8274ae63acfa1be3c2ebe064d134.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2908-0-0x0000000000400000-0x000000000086A000-memory.dmp	upx
behavioral1/files/0x000a0000000139e6-11.dat	upx
behavioral1/files/0x000a0000000139e6-13.dat	upx
behavioral1/memory/3024-17-0x0000000000400000-0x000000000086A000-memory.dmp	upx
behavioral1/files/0x000a0000000139e6-16.dat	upx

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2908	19eb8274ae63acfa1be3c2ebe064d134.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2908	19eb8274ae63acfa1be3c2ebe064d134.exe
3024	19eb8274ae63acfa1be3c2ebe064d134.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2908 wrote to memory of 3024	2908	19eb8274ae63acfa1be3c2ebe064d134.exe	28
PID 2908 wrote to memory of 3024	2908	19eb8274ae63acfa1be3c2ebe064d134.exe	28
PID 2908 wrote to memory of 3024	2908	19eb8274ae63acfa1be3c2ebe064d134.exe	28
PID 2908 wrote to memory of 3024	2908	19eb8274ae63acfa1be3c2ebe064d134.exe	28

C:\Users\Admin\AppData\Local\Temp\19eb8274ae63acfa1be3c2ebe064d134.exe
"C:\Users\Admin\AppData\Local\Temp\19eb8274ae63acfa1be3c2ebe064d134.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2908
- C:\Users\Admin\AppData\Local\Temp\19eb8274ae63acfa1be3c2ebe064d134.exe
  C:\Users\Admin\AppData\Local\Temp\19eb8274ae63acfa1be3c2ebe064d134.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:3024

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\19eb8274ae63acfa1be3c2ebe064d134.exe

Filesize
546KB

MD5
3531078640489a751aa42ced0e7dc6c6

SHA1
8f71daad12f1dfdbae545ddd84047726d3c5b346

SHA256
59a30944df168ef50141b17eb510b86dfc7b129064dbd3d5e9d58af5012a7eef

SHA512
7b84322e52aace31005cfdfeaf2cb79ca1c85ba84ce26b2dc73f4aef03ad27bf06b417aab2255df56708ddd86f1fa3d670f855541b6fb7cd97e6936a4972782c

Download Submit
C:\Users\Admin\AppData\Local\Temp\19eb8274ae63acfa1be3c2ebe064d134.exe

Filesize
514KB

MD5
1647d2af7a496db1cc0c2a020eb2c554

SHA1
8ff4ddc336d859ae51715c95beb1939371c5a223

SHA256
12b2aaa637a4ec3c0029d741a67886f62872f3183d07d38388bd88a0bd9341c7

SHA512
ec67d72ddca9c35663da869123426f7099e8a67d9c32ed192108b1a34d9d6479e7a7a447d2684789a5cdbe3a35b16ed11a2b9d1243b490d97466cea7185b45b7

Download Submit
\Users\Admin\AppData\Local\Temp\19eb8274ae63acfa1be3c2ebe064d134.exe

Filesize
621KB

MD5
d58b3364031a4732c88fab15c272666c

SHA1
b1f27e2e5aa7f6e4ad5f72b9e34792eaacd9622e

SHA256
0b3ce4553bc4b9449f8bf2f71d3c1db62c785dd91e1851cb855377c57adb4473

SHA512
3d49c6194b571da5d24069c71248b88c20fa11a4c75a9eeabeae66e9e7f6015d97b51cfa6fbe7426f80624ec1265ab5ba99634a73ffdab7b809666c1ccf726fe

Download Submit
memory/2908-0-0x0000000000400000-0x000000000086A000-memory.dmp

Filesize
4.4MB

Download
memory/2908-1-0x0000000000400000-0x00000000005F2000-memory.dmp

Filesize
1.9MB

Download
memory/2908-2-0x0000000000130000-0x0000000000242000-memory.dmp

Filesize
1.1MB

Download
memory/2908-15-0x00000000033E0000-0x000000000384A000-memory.dmp

Filesize
4.4MB

Download
memory/2908-14-0x0000000000400000-0x00000000005F2000-memory.dmp

Filesize
1.9MB

Download
memory/3024-17-0x0000000000400000-0x000000000086A000-memory.dmp

Filesize
4.4MB

Download
memory/3024-19-0x0000000000130000-0x0000000000242000-memory.dmp

Filesize
1.1MB

Download
memory/3024-18-0x0000000000400000-0x00000000005F2000-memory.dmp

Filesize
1.9MB

Download
memory/3024-26-0x0000000000400000-0x000000000086A000-memory.dmp

Filesize
4.4MB

Download