26429169d22ca444f7c6ad679b1ad27194a36f785ca27833656e57cebc081799

Analysis

max time kernel
46s
max time network
144s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 00:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

095718f3b00b8535b34c4844f3405439.exe
Size

2.6MB
MD5

095718f3b00b8535b34c4844f3405439
SHA1

e371d428c7944a4437cd7ab32e25b3b99a3efabf
SHA256

26429169d22ca444f7c6ad679b1ad27194a36f785ca27833656e57cebc081799
SHA512

59a695ed15ca2d44ed0f02c97154d8dd40574379068a62647d045ffd2af0c094f50a5ab7b00064744df5af26c4853c0384fbe69ab1ad97c25504e452be42e068
SSDEEP

49152:RsXoA4J2fYkkc0Z974YNNiY+5cXUsvVay3:6fzknTRRnV3

Score

7^/10

upx

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2656	095718f3b00b8535b34c4844f3405439.exe

Executes dropped EXE 1 IoCs

pid	Process
2656	095718f3b00b8535b34c4844f3405439.exe

Loads dropped DLL 1 IoCs

pid	Process
2628	095718f3b00b8535b34c4844f3405439.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2628-1-0x0000000000400000-0x0000000000D9E000-memory.dmp	upx
behavioral1/files/0x000b00000001225c-14.dat	upx
behavioral1/memory/2656-19-0x0000000000400000-0x0000000000D9E000-memory.dmp	upx
behavioral1/files/0x000b00000001225c-11.dat	upx

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2628	095718f3b00b8535b34c4844f3405439.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2628	095718f3b00b8535b34c4844f3405439.exe
2656	095718f3b00b8535b34c4844f3405439.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2628 wrote to memory of 2656	2628	095718f3b00b8535b34c4844f3405439.exe	20
PID 2628 wrote to memory of 2656	2628	095718f3b00b8535b34c4844f3405439.exe	20
PID 2628 wrote to memory of 2656	2628	095718f3b00b8535b34c4844f3405439.exe	20
PID 2628 wrote to memory of 2656	2628	095718f3b00b8535b34c4844f3405439.exe	20

C:\Users\Admin\AppData\Local\Temp\095718f3b00b8535b34c4844f3405439.exe
"C:\Users\Admin\AppData\Local\Temp\095718f3b00b8535b34c4844f3405439.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2628
- C:\Users\Admin\AppData\Local\Temp\095718f3b00b8535b34c4844f3405439.exe
  C:\Users\Admin\AppData\Local\Temp\095718f3b00b8535b34c4844f3405439.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:2656

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\095718f3b00b8535b34c4844f3405439.exe

Filesize
76KB

MD5
683e12e5f6a3519d179380aeeda8efae

SHA1
7bfd59d40f217912bd2417a8755006aab0a2d9ae

SHA256
cae9ead69edc2966bb892ae39146965945da0d550be653caac77b47efc3763c8

SHA512
4a19455f003025fb59e5699f596480a90325b7abb7c18d43babe92f8d628f11ea02c304d1c58eaed0f4b48a95bfb20d56ad83df553f3de123b24c3a2792b7d44

Download Submit
\Users\Admin\AppData\Local\Temp\095718f3b00b8535b34c4844f3405439.exe

Filesize
45KB

MD5
3ea8f9a849fcf9ffae5668fe794cacda

SHA1
bb8116b1bd7d46e84a9cf6cab8ada2559d946d05

SHA256
06fd3ddb7e535e91e2309ae8665eef78626121ebf1d22ace91ad7d6b9ce3381c

SHA512
72e2be1b9db1091d1099e394fd3b5fe217a413ad60f417efa5dd63daca4e53e1411c17532bf3cc4df844969abae6130348a79a6bc9121a793a041f622fa036b5

Download Submit
memory/2628-0-0x0000000000400000-0x0000000000605000-memory.dmp

Filesize
2.0MB

Download
memory/2628-4-0x0000000001FA0000-0x00000000021FA000-memory.dmp

Filesize
2.4MB

Download
memory/2628-1-0x0000000000400000-0x0000000000D9E000-memory.dmp

Filesize
9.6MB

Download
memory/2628-15-0x0000000000400000-0x0000000000605000-memory.dmp

Filesize
2.0MB

Download
memory/2628-16-0x00000000038A0000-0x000000000423E000-memory.dmp

Filesize
9.6MB

Download
memory/2628-25-0x00000000038A0000-0x000000000423E000-memory.dmp

Filesize
9.6MB

Download
memory/2656-19-0x0000000000400000-0x0000000000D9E000-memory.dmp

Filesize
9.6MB

Download
memory/2656-21-0x0000000002250000-0x00000000024AA000-memory.dmp

Filesize
2.4MB

Download
memory/2656-26-0x0000000000400000-0x0000000000D9E000-memory.dmp

Filesize
9.6MB

Download