c679b29fe34188400d2fd10c980afb05c6fe29decb26d2a1401476819a227833

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
30-12-2023 22:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1dd9f8f4ff8b00d975795cf912134f22.exe
Size

2.9MB
MD5

1dd9f8f4ff8b00d975795cf912134f22
SHA1

bc439bcd36034dd2a778acbb552d4cff08623cb2
SHA256

c679b29fe34188400d2fd10c980afb05c6fe29decb26d2a1401476819a227833
SHA512

abab95e3f1a6d6f528cd8764662ab064e874136d60a2a843720786dee06533e0b00fd0eae8c10348116b1710763aac431abee8a9fb9f035708001a69b64d97ae
SSDEEP

49152:Oej/azooWfH1Ke7D0QRdqzZN74NH5HUyNRcUsCVOzetdZJ:5+zbWrD0QKl4HBUCczzM3

Score

7^/10

upx

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2276	1dd9f8f4ff8b00d975795cf912134f22.exe

Executes dropped EXE 1 IoCs

pid	Process
2276	1dd9f8f4ff8b00d975795cf912134f22.exe

Loads dropped DLL 1 IoCs

pid	Process
1732	1dd9f8f4ff8b00d975795cf912134f22.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1732-0-0x0000000000400000-0x00000000008EF000-memory.dmp	upx
behavioral1/files/0x000b0000000122dc-15.dat	upx
behavioral1/files/0x000b0000000122dc-10.dat	upx

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1732	1dd9f8f4ff8b00d975795cf912134f22.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
1732	1dd9f8f4ff8b00d975795cf912134f22.exe
2276	1dd9f8f4ff8b00d975795cf912134f22.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1732 wrote to memory of 2276	1732	1dd9f8f4ff8b00d975795cf912134f22.exe	18
PID 1732 wrote to memory of 2276	1732	1dd9f8f4ff8b00d975795cf912134f22.exe	18
PID 1732 wrote to memory of 2276	1732	1dd9f8f4ff8b00d975795cf912134f22.exe	18
PID 1732 wrote to memory of 2276	1732	1dd9f8f4ff8b00d975795cf912134f22.exe	18

C:\Users\Admin\AppData\Local\Temp\1dd9f8f4ff8b00d975795cf912134f22.exe
"C:\Users\Admin\AppData\Local\Temp\1dd9f8f4ff8b00d975795cf912134f22.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1732
- C:\Users\Admin\AppData\Local\Temp\1dd9f8f4ff8b00d975795cf912134f22.exe
  C:\Users\Admin\AppData\Local\Temp\1dd9f8f4ff8b00d975795cf912134f22.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:2276

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\1dd9f8f4ff8b00d975795cf912134f22.exe

Filesize
98KB

MD5
8167fbb687280bcd19b9bcddcf6f458c

SHA1
413368cc08c9803a87071749fb63da82288a9b4c

SHA256
bcf3e2518c9f55b3c84d61b279788984c963ac07c77f16fd679b4c3f268d163b

SHA512
6517950fbc45c15056736410e17c354ce2aad5971f9a1376139fa052568bec6d61305f05edf0cd2da5c100a36944b395ace1abb9635f48194a3f2b09e4f52bc5

Download Submit
\Users\Admin\AppData\Local\Temp\1dd9f8f4ff8b00d975795cf912134f22.exe

Filesize
125KB

MD5
6a8409e8df8bc96c8806b55b75a94a76

SHA1
e0260d19cdd3e3bfb4f0adc83040877846f180c9

SHA256
c3e56f7fecf861f7c69a6ca826b220cc65f72ca4e49a1cf98369735499298cae

SHA512
03e9acfb29ed0d34df25f6bf919bc5130f0895443e8e54fee7442472afa4c4080933efa3f7c01f98e8f0b81085e1fa92c5df8d71c716270e6a0a8e92e8b728a6

Download Submit
memory/1732-13-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/1732-1-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/1732-0-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/1732-14-0x0000000003960000-0x0000000003E4F000-memory.dmp

Filesize
4.9MB

Download
memory/1732-30-0x0000000003960000-0x0000000003E4F000-memory.dmp

Filesize
4.9MB

Download
memory/1732-2-0x0000000000130000-0x0000000000263000-memory.dmp

Filesize
1.2MB

Download
memory/2276-24-0x0000000003410000-0x000000000363A000-memory.dmp

Filesize
2.2MB

Download
memory/2276-16-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/2276-18-0x0000000001B20000-0x0000000001C53000-memory.dmp

Filesize
1.2MB

Download
memory/2276-22-0x0000000000400000-0x000000000061D000-memory.dmp

Filesize
2.1MB

Download
memory/2276-31-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download