b7122051c697f1d3eccb933cb7698fd3df772b0adea2ac850b7b1dbaf9eecd70

Analysis

max time kernel
120s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30-12-2023 03:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0c7074170eafa76287667493522fed74.exe
Size

2.4MB
MD5

0c7074170eafa76287667493522fed74
SHA1

d70632742e303f665ff16e4d0e537e484934a95a
SHA256

b7122051c697f1d3eccb933cb7698fd3df772b0adea2ac850b7b1dbaf9eecd70
SHA512

694ea9fb6fe79a331fe69b6ce8240277a97d30086ebf6132e514574a7a0f210b9b29788d4ad81ddfedd2f9f4accb8d5850599a3bea6bc3763d56e2f9001a5333
SSDEEP

49152:cNBy4eU2D7Rxf3e+modZJ3Jd07wmVCP4M338dB2IBlGuuDVUsdxxjr:c79Ybf3e+BdZJ3X08m4gg3gnl/IVUs1P

Score

7^/10

upx

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2640	0c7074170eafa76287667493522fed74.exe

Executes dropped EXE 1 IoCs

pid	Process
2640	0c7074170eafa76287667493522fed74.exe

Loads dropped DLL 1 IoCs

pid	Process
2292	0c7074170eafa76287667493522fed74.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2292-0-0x0000000000400000-0x00000000008EF000-memory.dmp	upx
behavioral1/files/0x0009000000012270-10.dat	upx
behavioral1/files/0x0009000000012270-13.dat	upx
behavioral1/files/0x0009000000012270-12.dat	upx

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2292	0c7074170eafa76287667493522fed74.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2292	0c7074170eafa76287667493522fed74.exe
2640	0c7074170eafa76287667493522fed74.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2292 wrote to memory of 2640	2292	0c7074170eafa76287667493522fed74.exe	28
PID 2292 wrote to memory of 2640	2292	0c7074170eafa76287667493522fed74.exe	28
PID 2292 wrote to memory of 2640	2292	0c7074170eafa76287667493522fed74.exe	28
PID 2292 wrote to memory of 2640	2292	0c7074170eafa76287667493522fed74.exe	28

C:\Users\Admin\AppData\Local\Temp\0c7074170eafa76287667493522fed74.exe
"C:\Users\Admin\AppData\Local\Temp\0c7074170eafa76287667493522fed74.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2292
- C:\Users\Admin\AppData\Local\Temp\0c7074170eafa76287667493522fed74.exe
  C:\Users\Admin\AppData\Local\Temp\0c7074170eafa76287667493522fed74.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:2640

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\0c7074170eafa76287667493522fed74.exe

Filesize
320KB

MD5
b2414dc4c287f502a33a4eb2e7913aab

SHA1
bd3bb5a4e505d130c95880f449df5b06a9ed0f77

SHA256
dca86a1323eb71102c41fed7e3c3e7aab88d2895fd58253fc1a462f213115167

SHA512
2b5c6ebd06a247932c970d9b97219f98ecef7250585734c4c2d1c5505c5f2d842b3f53a565aaa915c9c5ca864bff40839945f965170d8517b65f3faf0ac442a4

Download Submit
C:\Users\Admin\AppData\Local\Temp\0c7074170eafa76287667493522fed74.exe

Filesize
192KB

MD5
8d708ddd38082d433914a4b0a18fe32b

SHA1
ecd5d39b3cc355ff8b0e5188261fe1085cef9f21

SHA256
a3a0cb3f1660b347103c0a2b4a57d6321d61fdf4f84975c57eb91b7707b13582

SHA512
1aee9aa1b9fab9c6481e9eaed0972903228f958b53394c9a516409ceb7a7c54b98045aa28e2cfb122ec0b49f23de8f61134345b9b0c5dfaa2aae9ce9cc2296a3

Download Submit
\Users\Admin\AppData\Local\Temp\0c7074170eafa76287667493522fed74.exe

Filesize
384KB

MD5
8e789c5d528814dc57ea2e1775da537e

SHA1
ee168916dc3e75f6b50be2127c3837b5e413c748

SHA256
de3fae7311484b473245d71e6060181bd6ed0abbf9eac01d39b7de039930b3e1

SHA512
03fd7e2ee4e9232adf541e713c7ddcc1d5a38ed2f0596256aee1d369c3fa3111de17f04925e8de1295bae9fc1d000b720fd7b075b1c14fc86ae9f9eab4ecdc1b

Download Submit
memory/2292-31-0x00000000039D0000-0x0000000003EBF000-memory.dmp

Filesize
4.9MB

Download
memory/2292-1-0x00000000018F0000-0x0000000001A23000-memory.dmp

Filesize
1.2MB

Download
memory/2292-2-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/2292-0-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/2292-16-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/2292-18-0x00000000039D0000-0x0000000003EBF000-memory.dmp

Filesize
4.9MB

Download
memory/2640-14-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/2640-22-0x0000000000400000-0x000000000061D000-memory.dmp

Filesize
2.1MB

Download
memory/2640-25-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/2640-28-0x00000000032D0000-0x00000000034FA000-memory.dmp

Filesize
2.2MB

Download
memory/2640-20-0x00000000002B0000-0x00000000003E3000-memory.dmp

Filesize
1.2MB

Download
memory/2640-32-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download