508900048781984adeb7b3988f32d0c2beabe80e737afc63b6bf8f0c46b9fd28

Analysis

max time kernel
239s
max time network
300s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29/12/2023, 22:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

0586c36bf4083ce1999ef51fce31b1de.exe
Size

2.7MB
MD5

0586c36bf4083ce1999ef51fce31b1de
SHA1

5990dca83dd97fd530152dc2ae6d7ee0b31ecf15
SHA256

508900048781984adeb7b3988f32d0c2beabe80e737afc63b6bf8f0c46b9fd28
SHA512

5fef23df99f6e2d138f06cffc6deaabd4e99466b5945531de2f7a1e8cacab0d2c33c883542e41e132b884c92755758bbd7fc6db745dfa223d35235de348ef8e8
SSDEEP

49152:41urNVw/VFiyJRQat8eDF/edHnulpft6MFgNi5wrsGaaUjtLq4WudMq43f:41ur6VpAm7F/wHMFsoG0x3WudMt3f

Score

7^/10

upx

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
592	0586c36bf4083ce1999ef51fce31b1de.exe

Executes dropped EXE 1 IoCs

pid	Process
592	0586c36bf4083ce1999ef51fce31b1de.exe

Loads dropped DLL 1 IoCs

pid	Process
1724	0586c36bf4083ce1999ef51fce31b1de.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1724-0-0x0000000000400000-0x00000000008EF000-memory.dmp	upx
behavioral1/files/0x0004000000004ed7-11.dat	upx
behavioral1/memory/1724-14-0x00000000038C0000-0x0000000003DAF000-memory.dmp	upx
behavioral1/files/0x0004000000004ed7-16.dat	upx

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1724	0586c36bf4083ce1999ef51fce31b1de.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
1724	0586c36bf4083ce1999ef51fce31b1de.exe
592	0586c36bf4083ce1999ef51fce31b1de.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1724 wrote to memory of 592	1724	0586c36bf4083ce1999ef51fce31b1de.exe	27
PID 1724 wrote to memory of 592	1724	0586c36bf4083ce1999ef51fce31b1de.exe	27
PID 1724 wrote to memory of 592	1724	0586c36bf4083ce1999ef51fce31b1de.exe	27
PID 1724 wrote to memory of 592	1724	0586c36bf4083ce1999ef51fce31b1de.exe	27

C:\Users\Admin\AppData\Local\Temp\0586c36bf4083ce1999ef51fce31b1de.exe
"C:\Users\Admin\AppData\Local\Temp\0586c36bf4083ce1999ef51fce31b1de.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1724
- C:\Users\Admin\AppData\Local\Temp\0586c36bf4083ce1999ef51fce31b1de.exe
  C:\Users\Admin\AppData\Local\Temp\0586c36bf4083ce1999ef51fce31b1de.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:592

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\0586c36bf4083ce1999ef51fce31b1de.exe

Filesize
1.6MB

MD5
bf94e4a0200da09d257abdb683ee81e3

SHA1
aaddebde77630578f9933c42a3cf99661a4da466

SHA256
16b86720934cdba75ea9f4cf6e768a83b1f74c545d3abfbc5dda97a2ac4bbc36

SHA512
f9fe95ddf74ada4488473549642928d273e2283860fe158a84b059d447d3795342b3f5ff6944da0261acd41f03d8f97de03346f1ee4fd9a3ec2de35741f3df65

Download Submit
\Users\Admin\AppData\Local\Temp\0586c36bf4083ce1999ef51fce31b1de.exe

Filesize
391KB

MD5
8c1e6690e715ea7a56ac6c5bc5858dfa

SHA1
c776df5f919c10d9e645935d922158530754b8df

SHA256
bceaf7e6ce6c2a9dffa3130696e1a5e2a369c2725da3b2a5542d90e264b5092e

SHA512
f596a74e0623a9138ff3fe20ca87b123e10c1ee61bf356b0eb61ccba2275e7a89c9989611ab4ff5e7a1363dc5946b8396f7b91526cf05623d02ab7aabe3a8500

Download Submit
memory/592-20-0x0000000001B20000-0x0000000001C53000-memory.dmp

Filesize
1.2MB

Download
memory/592-32-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/592-24-0x0000000000400000-0x000000000061D000-memory.dmp

Filesize
2.1MB

Download
memory/592-25-0x00000000035A0000-0x00000000037CA000-memory.dmp

Filesize
2.2MB

Download
memory/592-18-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/592-17-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/1724-10-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/1724-14-0x00000000038C0000-0x0000000003DAF000-memory.dmp

Filesize
4.9MB

Download
memory/1724-15-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/1724-0-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/1724-1-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/1724-2-0x00000000018F0000-0x0000000001A23000-memory.dmp

Filesize
1.2MB

Download