Analysis

  • max time kernel
    120s
  • max time network
    128s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    30/12/2023, 01:23

General

  • Target

    09f8cf217dc29001a8a1d8793623dd5e.exe

  • Size

    59KB

  • MD5

    09f8cf217dc29001a8a1d8793623dd5e

  • SHA1

    c183acecbc41b9fde109b9544443ba83e6eb7ea6

  • SHA256

    9dea4f44576f7f6cef409b36a3f6ac9e72d4ab08227c871998354f3799908c93

  • SHA512

    12e8f3d67761edd59a5ff338ce81a423697daca9172326e277ec1a27bc10f3235666c2a0cfe306e08c04ffb6b5e509eaf78e3fd15b02c1060e7c8acb385251e5

  • SSDEEP

    1536:hLUozsYU7HQtIP3BpgfasJ65xaZVwFFJhmze0GsVPCv/Sg:hwMsYAQuP3BpgiwWxSwnJhE9VPES

Score
7/10
upx

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\09f8cf217dc29001a8a1d8793623dd5e.exe
    "C:\Users\Admin\AppData\Local\Temp\09f8cf217dc29001a8a1d8793623dd5e.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: RenamesItself
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:2416
    • C:\Users\Admin\AppData\Local\Temp\09f8cf217dc29001a8a1d8793623dd5e.exe
      C:\Users\Admin\AppData\Local\Temp\09f8cf217dc29001a8a1d8793623dd5e.exe
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Suspicious use of UnmapMainImage
      PID:2312

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\09f8cf217dc29001a8a1d8793623dd5e.exe

    Filesize

    59KB

    MD5

    b317d1e02cda328f8744e42b9e8da0c6

    SHA1

    84d65a9afe61e4616a98e08283ca680fa54223bc

    SHA256

    ee182b0184c7ad8e33d1eec2a6f4d60e93cdc4c0b6f02506c11afd9082245f52

    SHA512

    d392752ad92702e7dbce31bf12d1a1c2e97e30797c3b2056ba067cd8c22b0a0bfc0fcb6b3a4f31e98ea7d5727aaf399d374c3d1e6e90e8c9b5e11eec8a7340a8

  • memory/2312-18-0x0000000000400000-0x000000000041D000-memory.dmp

    Filesize

    116KB

  • memory/2312-17-0x0000000000400000-0x000000000043D000-memory.dmp

    Filesize

    244KB

  • memory/2312-20-0x0000000000030000-0x000000000003F000-memory.dmp

    Filesize

    60KB

  • memory/2312-25-0x0000000000170000-0x000000000018D000-memory.dmp

    Filesize

    116KB

  • memory/2312-24-0x0000000000400000-0x000000000040E000-memory.dmp

    Filesize

    56KB

  • memory/2312-31-0x0000000000400000-0x000000000043D000-memory.dmp

    Filesize

    244KB

  • memory/2416-1-0x0000000000400000-0x000000000041D000-memory.dmp

    Filesize

    116KB

  • memory/2416-0-0x0000000000400000-0x000000000043D000-memory.dmp

    Filesize

    244KB

  • memory/2416-15-0x0000000000170000-0x00000000001AD000-memory.dmp

    Filesize

    244KB

  • memory/2416-8-0x0000000000030000-0x000000000003F000-memory.dmp

    Filesize

    60KB

  • memory/2416-14-0x0000000000400000-0x000000000041D000-memory.dmp

    Filesize

    116KB

  • memory/2416-30-0x0000000000170000-0x00000000001AD000-memory.dmp

    Filesize

    244KB