1a2a6043f55d1d1f9cfccd22794705249b77cb7b158e20d7217e052179bd9bc7

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
29/12/2023, 21:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

04fc9cfa373501815f82918aa522bce1.exe
Size

2.9MB
MD5

04fc9cfa373501815f82918aa522bce1
SHA1

7b534e8d0ebe8c38ad477ad1f8a54c9f3507821f
SHA256

1a2a6043f55d1d1f9cfccd22794705249b77cb7b158e20d7217e052179bd9bc7
SHA512

9556f41968a6e46b8697a8a2250c513614275f1fa725852ce024ff0e3bb4f7ab575ce2d9e9c1c811b687bd3ec1dab112891cf8b6e0dcb3b813da77501f2432af
SSDEEP

49152:I0fSffZVSSXIVFmzx3wp9Baj8BBT4SfcsUjoh48TyMPkXdwkyZ:MffZVP4nXpHau42c1joCjMPkNwk6

Score

7^/10

upx

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3000	04fc9cfa373501815f82918aa522bce1.exe

Executes dropped EXE 1 IoCs

pid	Process
3000	04fc9cfa373501815f82918aa522bce1.exe

Loads dropped DLL 1 IoCs

pid	Process
1752	04fc9cfa373501815f82918aa522bce1.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1752-0-0x0000000000400000-0x00000000008EF000-memory.dmp	upx
behavioral1/memory/1752-13-0x0000000003950000-0x0000000003E3F000-memory.dmp	upx
behavioral1/files/0x000a00000001650c-15.dat	upx
behavioral1/files/0x000a00000001650c-10.dat	upx

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1752	04fc9cfa373501815f82918aa522bce1.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
1752	04fc9cfa373501815f82918aa522bce1.exe
3000	04fc9cfa373501815f82918aa522bce1.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1752 wrote to memory of 3000	1752	04fc9cfa373501815f82918aa522bce1.exe	18
PID 1752 wrote to memory of 3000	1752	04fc9cfa373501815f82918aa522bce1.exe	18
PID 1752 wrote to memory of 3000	1752	04fc9cfa373501815f82918aa522bce1.exe	18
PID 1752 wrote to memory of 3000	1752	04fc9cfa373501815f82918aa522bce1.exe	18

C:\Users\Admin\AppData\Local\Temp\04fc9cfa373501815f82918aa522bce1.exe
"C:\Users\Admin\AppData\Local\Temp\04fc9cfa373501815f82918aa522bce1.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1752
- C:\Users\Admin\AppData\Local\Temp\04fc9cfa373501815f82918aa522bce1.exe
  C:\Users\Admin\AppData\Local\Temp\04fc9cfa373501815f82918aa522bce1.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:3000

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\04fc9cfa373501815f82918aa522bce1.exe

Filesize
893KB

MD5
ebc0527aba359f9472eb96a6435035fd

SHA1
4203077dd600de0cfd673511c044397ba5cc375b

SHA256
8a68b7bc8122968f0d10e16635c4c58fa0ab78499711929546a8b5f8f2837d6f

SHA512
c879adb596f0117cc508a1d714df9e46f03f57b090b9725ba78ac0b057e5837d798c12ae498ce88c4c06599187a61e6b88d060fcd9693bcbd552779ac1677c00

Download Submit
memory/1752-13-0x0000000003950000-0x0000000003E3F000-memory.dmp

Filesize
4.9MB

Download
memory/1752-1-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/1752-0-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/1752-14-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/1752-31-0x0000000003950000-0x0000000003E3F000-memory.dmp

Filesize
4.9MB

Download
memory/1752-2-0x00000000018F0000-0x0000000001A23000-memory.dmp

Filesize
1.2MB

Download
memory/3000-26-0x0000000003410000-0x000000000363A000-memory.dmp

Filesize
2.2MB

Download
memory/3000-16-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/3000-20-0x0000000001B20000-0x0000000001C53000-memory.dmp

Filesize
1.2MB

Download
memory/3000-23-0x0000000000400000-0x000000000061D000-memory.dmp

Filesize
2.1MB

Download
memory/3000-18-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/3000-32-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download