fd54c3ba5f46872afdf36334bc2c7a7dfc4d1aa97ade40f3def8f5b6fecefc8f

Analysis

max time kernel
119s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 08:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

132ad66647754c6872e2bd0717f13d4b.exe
Size

5.3MB
MD5

132ad66647754c6872e2bd0717f13d4b
SHA1

6f4620960eef2e06d4d242fe2aa6edd67265572e
SHA256

fd54c3ba5f46872afdf36334bc2c7a7dfc4d1aa97ade40f3def8f5b6fecefc8f
SHA512

ba520424d3be3879c717a9af93e870ea4fed4baebbc44e6df17f2faeb2fb40b929b0700e2185868fae3b3b4809da8c32727e2472a68bab14c7bd80c42ed17824
SSDEEP

98304:34YwhwgQ5oHbYpbuyptQxgCHC+c6dHXQaQflcB9I+MAhVeZuHbYpbuyptQxgCHCs:3OAXtQxgCHG2Aza7h4QAXtQxgCHG2D

Score

7^/10

upx

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3004	132ad66647754c6872e2bd0717f13d4b.exe

Executes dropped EXE 1 IoCs

pid	Process
3004	132ad66647754c6872e2bd0717f13d4b.exe

Loads dropped DLL 1 IoCs

pid	Process
1696	132ad66647754c6872e2bd0717f13d4b.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1696-1-0x0000000000400000-0x00000000008E7000-memory.dmp	upx
behavioral1/files/0x000800000000b529-13.dat	upx
behavioral1/files/0x000800000000b529-10.dat	upx

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1696	132ad66647754c6872e2bd0717f13d4b.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
1696	132ad66647754c6872e2bd0717f13d4b.exe
3004	132ad66647754c6872e2bd0717f13d4b.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1696 wrote to memory of 3004	1696	132ad66647754c6872e2bd0717f13d4b.exe	28
PID 1696 wrote to memory of 3004	1696	132ad66647754c6872e2bd0717f13d4b.exe	28
PID 1696 wrote to memory of 3004	1696	132ad66647754c6872e2bd0717f13d4b.exe	28
PID 1696 wrote to memory of 3004	1696	132ad66647754c6872e2bd0717f13d4b.exe	28

C:\Users\Admin\AppData\Local\Temp\132ad66647754c6872e2bd0717f13d4b.exe
"C:\Users\Admin\AppData\Local\Temp\132ad66647754c6872e2bd0717f13d4b.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1696
- C:\Users\Admin\AppData\Local\Temp\132ad66647754c6872e2bd0717f13d4b.exe
  C:\Users\Admin\AppData\Local\Temp\132ad66647754c6872e2bd0717f13d4b.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:3004

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\132ad66647754c6872e2bd0717f13d4b.exe

Filesize
894KB

MD5
bb999144c6d7a407ef60fa975302a3f6

SHA1
2e8699d781903466b96605936374d5d4229142d2

SHA256
be5ccdfcd227a065b3562882a1c2d2e07db7c68152e1b5b9a8a26b2e89a86550

SHA512
c0d16a7b68fb83762ad82d355e898a8b937519221b33a78653f24bb399856259819d2fe8a930d4969cee10c2a62692e2bf8b73821bee7bb2c2b905d1dd132589

Download Submit
\Users\Admin\AppData\Local\Temp\132ad66647754c6872e2bd0717f13d4b.exe

Filesize
1.1MB

MD5
15c2af4ed54d8fd9e8a003214f25069f

SHA1
21a917f14be212b0c1963df433bb0947be68cc3a

SHA256
3673f424cc4e9f7a517be756cc1ac9ce88227744e3de4ad9248525fa3865232b

SHA512
efcf53fa1e6b208800bd5e901396b38935934594c0ed09ce9bac9e86faba5f4d5a98659b951fcbd547bc67f09d7c8535843213192bc91080692159f1414cf0d3

Download Submit
memory/1696-0-0x0000000000400000-0x0000000000622000-memory.dmp

Filesize
2.1MB

Download
memory/1696-1-0x0000000000400000-0x00000000008E7000-memory.dmp

Filesize
4.9MB

Download
memory/1696-2-0x0000000001B10000-0x0000000001C41000-memory.dmp

Filesize
1.2MB

Download
memory/1696-14-0x0000000000400000-0x0000000000622000-memory.dmp

Filesize
2.1MB

Download
memory/3004-16-0x00000000018F0000-0x0000000001A21000-memory.dmp

Filesize
1.2MB

Download
memory/3004-18-0x0000000000400000-0x00000000008E7000-memory.dmp

Filesize
4.9MB

Download
memory/3004-23-0x0000000003550000-0x0000000003772000-memory.dmp

Filesize
2.1MB

Download
memory/3004-22-0x0000000000400000-0x0000000000616000-memory.dmp

Filesize
2.1MB

Download
memory/3004-15-0x0000000000400000-0x0000000000622000-memory.dmp

Filesize
2.1MB

Download
memory/3004-30-0x0000000000400000-0x00000000008E7000-memory.dmp

Filesize
4.9MB

Download