a6788d0ba5dc8c7940d38e3eb84e8d632659f9b7e2391e77d5ffb8098221c969

Analysis

max time kernel
120s
max time network
146s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30-12-2023 03:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0c9c8df12e60f1113ff133ebfdc9c4cc.exe
Size

1.3MB
MD5

0c9c8df12e60f1113ff133ebfdc9c4cc
SHA1

0575f40a7ec59ab91c0a4410741c98e0c482c96b
SHA256

a6788d0ba5dc8c7940d38e3eb84e8d632659f9b7e2391e77d5ffb8098221c969
SHA512

cd97225bb9ddcb6ff60eef95e3a59a5bb265ef225fa331a7fb391f30f3d17e0a492217ce81117e4a5cd98d0bddc834112c58f11012bab812032d1e1f367d7a5d
SSDEEP

24576:qzy2Zrbh6AN+DRI1127mt43Okd4v+RdYJ92pw5JPnDTP9wKaeEB9rwdVAyGXn5YV:Ch7N+DReZPl+RDpwPfDTTaBz4Nj3f

Score

7^/10

upx

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1720	0c9c8df12e60f1113ff133ebfdc9c4cc.exe

Executes dropped EXE 1 IoCs

pid	Process
1720	0c9c8df12e60f1113ff133ebfdc9c4cc.exe

Loads dropped DLL 1 IoCs

pid	Process
2540	0c9c8df12e60f1113ff133ebfdc9c4cc.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2540-0-0x0000000000400000-0x00000000008EF000-memory.dmp	upx
behavioral1/files/0x0007000000012284-10.dat	upx
behavioral1/files/0x0007000000012284-15.dat	upx
behavioral1/memory/1720-16-0x0000000000400000-0x00000000008EF000-memory.dmp	upx

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2540	0c9c8df12e60f1113ff133ebfdc9c4cc.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2540	0c9c8df12e60f1113ff133ebfdc9c4cc.exe
1720	0c9c8df12e60f1113ff133ebfdc9c4cc.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2540 wrote to memory of 1720	2540	0c9c8df12e60f1113ff133ebfdc9c4cc.exe	28
PID 2540 wrote to memory of 1720	2540	0c9c8df12e60f1113ff133ebfdc9c4cc.exe	28
PID 2540 wrote to memory of 1720	2540	0c9c8df12e60f1113ff133ebfdc9c4cc.exe	28
PID 2540 wrote to memory of 1720	2540	0c9c8df12e60f1113ff133ebfdc9c4cc.exe	28

C:\Users\Admin\AppData\Local\Temp\0c9c8df12e60f1113ff133ebfdc9c4cc.exe
"C:\Users\Admin\AppData\Local\Temp\0c9c8df12e60f1113ff133ebfdc9c4cc.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2540
- C:\Users\Admin\AppData\Local\Temp\0c9c8df12e60f1113ff133ebfdc9c4cc.exe
  C:\Users\Admin\AppData\Local\Temp\0c9c8df12e60f1113ff133ebfdc9c4cc.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:1720

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\0c9c8df12e60f1113ff133ebfdc9c4cc.exe

Filesize
505KB

MD5
41b5d6cc0cb45e4082f79366754a214c

SHA1
c2ace0ccbed15de73eeb80e912c8b78e87ef5bee

SHA256
74aa680e8c04ecf2dfeec20ddcf801705241b0ee746608739047e1f388e29aae

SHA512
d3f545e46e829d88e40bb2f65eec0810d0dfbfb40f288baa02eea217ed333b0af710eda361557c499cf6bfe97267b492fea9208159a5fe1fd94e077967af5d1b

Download Submit
\Users\Admin\AppData\Local\Temp\0c9c8df12e60f1113ff133ebfdc9c4cc.exe

Filesize
574KB

MD5
2abdfc2952af48bf62b3a6996624e481

SHA1
2efb5c0b0d27c71203cdd5f7a07d014de99aebe2

SHA256
774dd964506c71eaf7913a119066c5ec84e86cbbcfb86a0d26fd6e583eb76fd4

SHA512
04211a3e5f8ac67df54721fd5e425a68e2cb7b944a7df15278b673261fe674d28139d6c27f4d92e016f4cb2dbda45e29ea2537a4dd69d4837073c13ff55ba0c1

Download Submit
memory/1720-16-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/1720-18-0x0000000001B20000-0x0000000001C53000-memory.dmp

Filesize
1.2MB

Download
memory/1720-17-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/1720-23-0x0000000000400000-0x000000000061D000-memory.dmp

Filesize
2.1MB

Download
memory/1720-25-0x0000000003410000-0x000000000363A000-memory.dmp

Filesize
2.2MB

Download
memory/1720-32-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/2540-2-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/2540-1-0x0000000001B20000-0x0000000001C53000-memory.dmp

Filesize
1.2MB

Download
memory/2540-14-0x00000000034D0000-0x00000000039BF000-memory.dmp

Filesize
4.9MB

Download
memory/2540-0-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/2540-13-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/2540-31-0x00000000034D0000-0x00000000039BF000-memory.dmp

Filesize
4.9MB

Download