e24f3f247e560cc3f7cf04df04b1d1fc508b6b9525a95c79d4970ef7755e53b7

Analysis

max time kernel
121s
max time network
131s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 23:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

20296f558f2e1265e46148e742250e7f.exe
Size

1.3MB
MD5

20296f558f2e1265e46148e742250e7f
SHA1

99bc12048fc780d30aaea5812b34dff2bf6254a3
SHA256

e24f3f247e560cc3f7cf04df04b1d1fc508b6b9525a95c79d4970ef7755e53b7
SHA512

23db94053384ea4b3ca533922c4df02f1ec65bdf6d235b0ae4d557615bf57b0db245705e8a47d29a66147ac4185441766522f40cbc75d40c5b45507723796c37
SSDEEP

24576:OuVSdZlDLxez0nuz0xbSkoasK8+C8zu5t5CajYmoqACoXzvG:03uzTN18zy5C4YaAl

Score

7^/10

upx

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3040	20296f558f2e1265e46148e742250e7f.exe

Executes dropped EXE 1 IoCs

pid	Process
3040	20296f558f2e1265e46148e742250e7f.exe

Loads dropped DLL 1 IoCs

pid	Process
2372	20296f558f2e1265e46148e742250e7f.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2372-1-0x0000000000400000-0x000000000086A000-memory.dmp	upx
behavioral1/files/0x0009000000015c33-11.dat	upx
behavioral1/files/0x0009000000015c33-14.dat	upx

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2372	20296f558f2e1265e46148e742250e7f.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2372	20296f558f2e1265e46148e742250e7f.exe
3040	20296f558f2e1265e46148e742250e7f.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2372 wrote to memory of 3040	2372	20296f558f2e1265e46148e742250e7f.exe	17
PID 2372 wrote to memory of 3040	2372	20296f558f2e1265e46148e742250e7f.exe	17
PID 2372 wrote to memory of 3040	2372	20296f558f2e1265e46148e742250e7f.exe	17
PID 2372 wrote to memory of 3040	2372	20296f558f2e1265e46148e742250e7f.exe	17

C:\Users\Admin\AppData\Local\Temp\20296f558f2e1265e46148e742250e7f.exe
"C:\Users\Admin\AppData\Local\Temp\20296f558f2e1265e46148e742250e7f.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2372
- C:\Users\Admin\AppData\Local\Temp\20296f558f2e1265e46148e742250e7f.exe
  C:\Users\Admin\AppData\Local\Temp\20296f558f2e1265e46148e742250e7f.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:3040

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\20296f558f2e1265e46148e742250e7f.exe

Filesize
369KB

MD5
b03de01d628c70890f9ebea84f2d6a4b

SHA1
e61450540449d79fef87eddd32dfc5842f15fdcb

SHA256
bfbae56299e01c0df44eac67a04d4182ed610d036883073464042bbf08706edb

SHA512
7dd3d3db7972ebadc6324718ce7bf3a76a0d91359f96844048122793fad51cd736ae0989b9a84e605a4a574dc3f3fbb1c935caebe854ee2179cae5a26b23ffd0

Download Submit
\Users\Admin\AppData\Local\Temp\20296f558f2e1265e46148e742250e7f.exe

Filesize
361KB

MD5
ada0209b0dab824796c0bca9ce08f3ce

SHA1
9e227a5438eb3a99a2e896c89a27305ff9a2d6cb

SHA256
8b92cdcf4122242348d132f0b34925951623d7ffb461824aa8d0c561933a4981

SHA512
171d496fd4ecbbd1b149d9a23d633aded92cd9de76b590ef3f72b3060d18abddc58e28bf1db1f5567379f4946857c14fa0347328a433e7b22ccd960af7267ba5

Download Submit
memory/2372-1-0x0000000000400000-0x000000000086A000-memory.dmp

Filesize
4.4MB

Download
memory/2372-3-0x00000000002A0000-0x00000000003B2000-memory.dmp

Filesize
1.1MB

Download
memory/2372-0-0x0000000000400000-0x00000000005F2000-memory.dmp

Filesize
1.9MB

Download
memory/2372-16-0x0000000003530000-0x000000000399A000-memory.dmp

Filesize
4.4MB

Download
memory/2372-15-0x0000000000400000-0x00000000005F2000-memory.dmp

Filesize
1.9MB

Download
memory/2372-26-0x0000000003530000-0x000000000399A000-memory.dmp

Filesize
4.4MB

Download
memory/3040-18-0x0000000000400000-0x000000000086A000-memory.dmp

Filesize
4.4MB

Download
memory/3040-20-0x00000000002C0000-0x00000000003D2000-memory.dmp

Filesize
1.1MB

Download
memory/3040-17-0x0000000000400000-0x00000000005F2000-memory.dmp

Filesize
1.9MB

Download
memory/3040-27-0x0000000000400000-0x000000000086A000-memory.dmp

Filesize
4.4MB

Download