9dea4f44576f7f6cef409b36a3f6ac9e72d4ab08227c871998354f3799908c93

Analysis

max time kernel
120s
max time network
128s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 01:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

09f8cf217dc29001a8a1d8793623dd5e.exe
Size

59KB
MD5

09f8cf217dc29001a8a1d8793623dd5e
SHA1

c183acecbc41b9fde109b9544443ba83e6eb7ea6
SHA256

9dea4f44576f7f6cef409b36a3f6ac9e72d4ab08227c871998354f3799908c93
SHA512

12e8f3d67761edd59a5ff338ce81a423697daca9172326e277ec1a27bc10f3235666c2a0cfe306e08c04ffb6b5e509eaf78e3fd15b02c1060e7c8acb385251e5
SSDEEP

1536:hLUozsYU7HQtIP3BpgfasJ65xaZVwFFJhmze0GsVPCv/Sg:hwMsYAQuP3BpgiwWxSwnJhE9VPES

Score

7^/10

upx

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2312	09f8cf217dc29001a8a1d8793623dd5e.exe

Executes dropped EXE 1 IoCs

pid	Process
2312	09f8cf217dc29001a8a1d8793623dd5e.exe

Loads dropped DLL 1 IoCs

pid	Process
2416	09f8cf217dc29001a8a1d8793623dd5e.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2416-0-0x0000000000400000-0x000000000043D000-memory.dmp	upx
behavioral1/memory/2312-17-0x0000000000400000-0x000000000043D000-memory.dmp	upx
behavioral1/files/0x0008000000012254-16.dat	upx

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2416	09f8cf217dc29001a8a1d8793623dd5e.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2416	09f8cf217dc29001a8a1d8793623dd5e.exe
2312	09f8cf217dc29001a8a1d8793623dd5e.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2416 wrote to memory of 2312	2416	09f8cf217dc29001a8a1d8793623dd5e.exe	29
PID 2416 wrote to memory of 2312	2416	09f8cf217dc29001a8a1d8793623dd5e.exe	29
PID 2416 wrote to memory of 2312	2416	09f8cf217dc29001a8a1d8793623dd5e.exe	29
PID 2416 wrote to memory of 2312	2416	09f8cf217dc29001a8a1d8793623dd5e.exe	29

C:\Users\Admin\AppData\Local\Temp\09f8cf217dc29001a8a1d8793623dd5e.exe
"C:\Users\Admin\AppData\Local\Temp\09f8cf217dc29001a8a1d8793623dd5e.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2416
- C:\Users\Admin\AppData\Local\Temp\09f8cf217dc29001a8a1d8793623dd5e.exe
  C:\Users\Admin\AppData\Local\Temp\09f8cf217dc29001a8a1d8793623dd5e.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:2312

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\09f8cf217dc29001a8a1d8793623dd5e.exe

Filesize
59KB

MD5
b317d1e02cda328f8744e42b9e8da0c6

SHA1
84d65a9afe61e4616a98e08283ca680fa54223bc

SHA256
ee182b0184c7ad8e33d1eec2a6f4d60e93cdc4c0b6f02506c11afd9082245f52

SHA512
d392752ad92702e7dbce31bf12d1a1c2e97e30797c3b2056ba067cd8c22b0a0bfc0fcb6b3a4f31e98ea7d5727aaf399d374c3d1e6e90e8c9b5e11eec8a7340a8

Download Submit
memory/2312-18-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/2312-17-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/2312-20-0x0000000000030000-0x000000000003F000-memory.dmp

Filesize
60KB

Download
memory/2312-25-0x0000000000170000-0x000000000018D000-memory.dmp

Filesize
116KB

Download
memory/2312-24-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2312-31-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/2416-1-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/2416-0-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/2416-15-0x0000000000170000-0x00000000001AD000-memory.dmp

Filesize
244KB

Download
memory/2416-8-0x0000000000030000-0x000000000003F000-memory.dmp

Filesize
60KB

Download
memory/2416-14-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/2416-30-0x0000000000170000-0x00000000001AD000-memory.dmp

Filesize
244KB

Download