f68c59c92102c7d5c6f6296680a42da562c2b241243efa0a0b74d0492b8a8363

Analysis

max time kernel
119s
max time network
127s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30-12-2023 23:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2065b8647d62c3963d7104773b85de86.exe
Size

5.8MB
MD5

2065b8647d62c3963d7104773b85de86
SHA1

850236a06177b81081a32dade04d9abce11d44dc
SHA256

f68c59c92102c7d5c6f6296680a42da562c2b241243efa0a0b74d0492b8a8363
SHA512

a0d17adfe94fb991992958c710de8f079fd4da1c0e91672c8b554ed33a1be13b27eb14ce37cacd8085055d1bcc787196ab1979d90ae2ebd0f992396114e6f57e
SSDEEP

98304:mz68VGA0L3z6Hau42c1joCjMPkNwk6alDAqD7z3uboHau42c1joCjMPkNwk6:mz6U0Qauq1jI86FA7y2auq1jI86

Score

7^/10

upx

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2232	2065b8647d62c3963d7104773b85de86.exe

Executes dropped EXE 1 IoCs

pid	Process
2232	2065b8647d62c3963d7104773b85de86.exe

Loads dropped DLL 1 IoCs

pid	Process
2464	2065b8647d62c3963d7104773b85de86.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2464-0-0x0000000000400000-0x00000000008EF000-memory.dmp	upx
behavioral1/files/0x00080000000120dc-10.dat	upx
behavioral1/memory/2464-14-0x0000000003F60000-0x000000000444F000-memory.dmp	upx
behavioral1/memory/2232-17-0x0000000000400000-0x00000000008EF000-memory.dmp	upx

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2464	2065b8647d62c3963d7104773b85de86.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2464	2065b8647d62c3963d7104773b85de86.exe
2232	2065b8647d62c3963d7104773b85de86.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2464 wrote to memory of 2232	2464	2065b8647d62c3963d7104773b85de86.exe	28
PID 2464 wrote to memory of 2232	2464	2065b8647d62c3963d7104773b85de86.exe	28
PID 2464 wrote to memory of 2232	2464	2065b8647d62c3963d7104773b85de86.exe	28
PID 2464 wrote to memory of 2232	2464	2065b8647d62c3963d7104773b85de86.exe	28

C:\Users\Admin\AppData\Local\Temp\2065b8647d62c3963d7104773b85de86.exe
"C:\Users\Admin\AppData\Local\Temp\2065b8647d62c3963d7104773b85de86.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2464
- C:\Users\Admin\AppData\Local\Temp\2065b8647d62c3963d7104773b85de86.exe
  C:\Users\Admin\AppData\Local\Temp\2065b8647d62c3963d7104773b85de86.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:2232

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\2065b8647d62c3963d7104773b85de86.exe

Filesize
381KB

MD5
e71bcacc1103320c39d864c361e0d577

SHA1
6b310451e6311a4a81aa2b23d6ea2e9a9f62e67e

SHA256
3e946aeb4293650ba98b16aa43294c0e91cfcf34745a05aacab37264efa738a3

SHA512
563a3e2f3354cd1cc077501b5ca5671197ff6f2da071984164d72a9c84712809acb30c92ab165c77fcd4eb1b44f08f246d0304a972e52d157cdb1e0c3cf69e2f

Download Submit
memory/2232-19-0x0000000001B20000-0x0000000001C53000-memory.dmp

Filesize
1.2MB

Download
memory/2232-17-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/2232-23-0x0000000000400000-0x000000000061D000-memory.dmp

Filesize
2.1MB

Download
memory/2232-25-0x00000000035A0000-0x00000000037CA000-memory.dmp

Filesize
2.2MB

Download
memory/2232-16-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/2232-32-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/2464-2-0x0000000001B20000-0x0000000001C53000-memory.dmp

Filesize
1.2MB

Download
memory/2464-1-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/2464-14-0x0000000003F60000-0x000000000444F000-memory.dmp

Filesize
4.9MB

Download
memory/2464-0-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/2464-13-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/2464-31-0x0000000003F60000-0x000000000444F000-memory.dmp

Filesize
4.9MB

Download