1dbda90b33797c42229b56f840ad8c9cdef31f8242db211ffed7b75f2679d93e

Analysis

max time kernel
119s
max time network
129s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29/12/2023, 18:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

00ee344177ce1d78fc3385cb4aac3201.exe
Size

2.7MB
MD5

00ee344177ce1d78fc3385cb4aac3201
SHA1

03e8782cd47b3e7261be9023dfeb1f80ca1c473e
SHA256

1dbda90b33797c42229b56f840ad8c9cdef31f8242db211ffed7b75f2679d93e
SHA512

04c50922da0bf021842faec568957a2c384d5539b4d2e703daef1fbbf79aa7f031a55b5d939259eb694ea9271c91243e6b8f777ab2f2c4a4d8ecfcccbfd79baa
SSDEEP

49152:Y9jh77xIcVABS3ppt/JR9ktBc1+Q4YdxSChG38bDUggR9t:K1ABEpVHktBcwQDM2YIDULHt

Score

7^/10

upx

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2772	00ee344177ce1d78fc3385cb4aac3201.exe

Executes dropped EXE 1 IoCs

pid	Process
2772	00ee344177ce1d78fc3385cb4aac3201.exe

Loads dropped DLL 1 IoCs

pid	Process
2400	00ee344177ce1d78fc3385cb4aac3201.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2400-0-0x0000000000400000-0x00000000008E7000-memory.dmp	upx
behavioral1/files/0x000b000000012238-10.dat	upx
behavioral1/memory/2772-16-0x0000000000400000-0x00000000008E7000-memory.dmp	upx

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2400	00ee344177ce1d78fc3385cb4aac3201.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2400	00ee344177ce1d78fc3385cb4aac3201.exe
2772	00ee344177ce1d78fc3385cb4aac3201.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2400 wrote to memory of 2772	2400	00ee344177ce1d78fc3385cb4aac3201.exe	28
PID 2400 wrote to memory of 2772	2400	00ee344177ce1d78fc3385cb4aac3201.exe	28
PID 2400 wrote to memory of 2772	2400	00ee344177ce1d78fc3385cb4aac3201.exe	28
PID 2400 wrote to memory of 2772	2400	00ee344177ce1d78fc3385cb4aac3201.exe	28

C:\Users\Admin\AppData\Local\Temp\00ee344177ce1d78fc3385cb4aac3201.exe
"C:\Users\Admin\AppData\Local\Temp\00ee344177ce1d78fc3385cb4aac3201.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2400
- C:\Users\Admin\AppData\Local\Temp\00ee344177ce1d78fc3385cb4aac3201.exe
  C:\Users\Admin\AppData\Local\Temp\00ee344177ce1d78fc3385cb4aac3201.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:2772

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\00ee344177ce1d78fc3385cb4aac3201.exe

Filesize
2.7MB

MD5
df026c458d3ac04b467220bdbbec38a3

SHA1
f2281c2317cef11c7f96e32d890b088a070a7623

SHA256
bf26ea06a7a359e6d05e871adc83ac478eb3fa7d062b75689297182b1f474cfd

SHA512
12d32f23e46e23c37a01767181bef1ee23ae492e837d40797f1d7da623a299ec63c231b904901b794673aaacf3e26c4baa41477b95b2cb641602908832e391fe

Download Submit
memory/2400-15-0x0000000003760000-0x0000000003C47000-memory.dmp

Filesize
4.9MB

Download
memory/2400-2-0x0000000000400000-0x0000000000622000-memory.dmp

Filesize
2.1MB

Download
memory/2400-1-0x0000000001B10000-0x0000000001C41000-memory.dmp

Filesize
1.2MB

Download
memory/2400-14-0x0000000000400000-0x0000000000622000-memory.dmp

Filesize
2.1MB

Download
memory/2400-0-0x0000000000400000-0x00000000008E7000-memory.dmp

Filesize
4.9MB

Download
memory/2400-31-0x0000000003760000-0x0000000003C47000-memory.dmp

Filesize
4.9MB

Download
memory/2772-16-0x0000000000400000-0x00000000008E7000-memory.dmp

Filesize
4.9MB

Download
memory/2772-17-0x0000000001B10000-0x0000000001C41000-memory.dmp

Filesize
1.2MB

Download
memory/2772-18-0x0000000000400000-0x0000000000622000-memory.dmp

Filesize
2.1MB

Download
memory/2772-23-0x0000000000400000-0x0000000000616000-memory.dmp

Filesize
2.1MB

Download
memory/2772-24-0x00000000033F0000-0x0000000003612000-memory.dmp

Filesize
2.1MB

Download
memory/2772-32-0x0000000000400000-0x00000000008E7000-memory.dmp

Filesize
4.9MB

Download