a276727b5ab0ffc4c8ab2b1b76b9d0b2cbb6486c5391e7c627b81d16f68a33d7

Analysis

max time kernel
119s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30-12-2023 21:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1d76b73c7224ed52b7f95f04c53340a2.exe
Size

2.9MB
MD5

1d76b73c7224ed52b7f95f04c53340a2
SHA1

62930df7c604622572482afe2c53e01e3b2076a5
SHA256

a276727b5ab0ffc4c8ab2b1b76b9d0b2cbb6486c5391e7c627b81d16f68a33d7
SHA512

570efc80a1371c04d8764cbaa373e6dfe4d54adde4ba3dc9b39f899bc330faecb4d48a4fb2e8f64f2f470e59443ae8b918353f4c44c9765a99ced88476b6dd8d
SSDEEP

49152:aHmD7xeTQXx8hSVtevt4wvkQdpvP4M338dB2IBlGuuDVUsdxxjeQZwxPYRKs:tvgkX5VteZcQdpvgg3gnl/IVUs1jePs

Score

7^/10

upx

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2888	1d76b73c7224ed52b7f95f04c53340a2.exe

Executes dropped EXE 1 IoCs

pid	Process
2888	1d76b73c7224ed52b7f95f04c53340a2.exe

Loads dropped DLL 1 IoCs

pid	Process
1992	1d76b73c7224ed52b7f95f04c53340a2.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1992-0-0x0000000000400000-0x00000000008EF000-memory.dmp	upx
behavioral1/files/0x000c000000012327-13.dat	upx
behavioral1/files/0x000c000000012327-10.dat	upx

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1992	1d76b73c7224ed52b7f95f04c53340a2.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
1992	1d76b73c7224ed52b7f95f04c53340a2.exe
2888	1d76b73c7224ed52b7f95f04c53340a2.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1992 wrote to memory of 2888	1992	1d76b73c7224ed52b7f95f04c53340a2.exe	28
PID 1992 wrote to memory of 2888	1992	1d76b73c7224ed52b7f95f04c53340a2.exe	28
PID 1992 wrote to memory of 2888	1992	1d76b73c7224ed52b7f95f04c53340a2.exe	28
PID 1992 wrote to memory of 2888	1992	1d76b73c7224ed52b7f95f04c53340a2.exe	28

C:\Users\Admin\AppData\Local\Temp\1d76b73c7224ed52b7f95f04c53340a2.exe
"C:\Users\Admin\AppData\Local\Temp\1d76b73c7224ed52b7f95f04c53340a2.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1992
- C:\Users\Admin\AppData\Local\Temp\1d76b73c7224ed52b7f95f04c53340a2.exe
  C:\Users\Admin\AppData\Local\Temp\1d76b73c7224ed52b7f95f04c53340a2.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:2888

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\1d76b73c7224ed52b7f95f04c53340a2.exe

Filesize
95KB

MD5
3e2dfc90d1e44e3bc6d720e0bc611277

SHA1
1cf8216e670c832ff6c73294a574092eeaaf0336

SHA256
9264430e904834bdbeadb4daf0d9d481f04d048979e2ccb6cac227a5c36a9d7a

SHA512
240b9bf41e87c5c3de2d0bdbbb5b65a748abeabd131cedd139150bbef8db6625a1f93094394eee7a309cc9fbec85af80ebd3d2a43704317fb331d14d18b83518

Download Submit
\Users\Admin\AppData\Local\Temp\1d76b73c7224ed52b7f95f04c53340a2.exe

Filesize
1.4MB

MD5
6578c8bf8442ac66b8afd818cf3e9953

SHA1
6595bac1b2ffb7cff6dff80f7ded7fce53388336

SHA256
4acf70ff9d6f2e54c0b90ff58eb47ba7c09a8c9bbfdf028552c499a97760617e

SHA512
9ef9b890aa0d57dd7bb93ad8ef0ed97f1c70006aa204af0721e97c1d338b1725dac1f1a9927be20852d70c44865646326565807b5d988f6fac47936d80d7e652

Download Submit
memory/1992-16-0x00000000036B0000-0x0000000003B9F000-memory.dmp

Filesize
4.9MB

Download
memory/1992-1-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/1992-2-0x00000000002B0000-0x00000000003E3000-memory.dmp

Filesize
1.2MB

Download
memory/1992-14-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/1992-0-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/2888-23-0x0000000000400000-0x000000000061D000-memory.dmp

Filesize
2.1MB

Download
memory/2888-20-0x0000000000130000-0x0000000000263000-memory.dmp

Filesize
1.2MB

Download
memory/2888-15-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/2888-24-0x0000000003400000-0x000000000362A000-memory.dmp

Filesize
2.2MB

Download
memory/2888-18-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/2888-31-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download