b6659705115af5fba5bbcf1dec726a1917382a5a585ecd670d66cf20e63cf905

Analysis

max time kernel
120s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 08:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1342d58b2a1dfddc7e4fcb61a47b5b46.exe
Size

5.3MB
MD5

1342d58b2a1dfddc7e4fcb61a47b5b46
SHA1

88a651d68400e60029a57f54af839e2bf560c377
SHA256

b6659705115af5fba5bbcf1dec726a1917382a5a585ecd670d66cf20e63cf905
SHA512

ece90c5bda5a978a49573f024103e3595273abc248305578e99fb6601764f7c95523028ae63342d018dd95db2c4f8e69562d406c1b3dd91eb505e0a6d7ff0d70
SSDEEP

98304:6MHmXscxlC3OydAcLmndE8+Xmj/os3MJoGeUiDtndE8+:6MHmXscxo3OydA0mn68+kwsrG1iDtn6H

Score

7^/10

upx

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1076	1342d58b2a1dfddc7e4fcb61a47b5b46.exe

Executes dropped EXE 1 IoCs

pid	Process
1076	1342d58b2a1dfddc7e4fcb61a47b5b46.exe

Loads dropped DLL 1 IoCs

pid	Process
1764	1342d58b2a1dfddc7e4fcb61a47b5b46.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1764-0-0x0000000000400000-0x000000000086A000-memory.dmp	upx
behavioral1/files/0x000b000000012261-15.dat	upx
behavioral1/files/0x000b000000012261-11.dat	upx

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1764	1342d58b2a1dfddc7e4fcb61a47b5b46.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
1764	1342d58b2a1dfddc7e4fcb61a47b5b46.exe
1076	1342d58b2a1dfddc7e4fcb61a47b5b46.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1764 wrote to memory of 1076	1764	1342d58b2a1dfddc7e4fcb61a47b5b46.exe	28
PID 1764 wrote to memory of 1076	1764	1342d58b2a1dfddc7e4fcb61a47b5b46.exe	28
PID 1764 wrote to memory of 1076	1764	1342d58b2a1dfddc7e4fcb61a47b5b46.exe	28
PID 1764 wrote to memory of 1076	1764	1342d58b2a1dfddc7e4fcb61a47b5b46.exe	28

C:\Users\Admin\AppData\Local\Temp\1342d58b2a1dfddc7e4fcb61a47b5b46.exe
"C:\Users\Admin\AppData\Local\Temp\1342d58b2a1dfddc7e4fcb61a47b5b46.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1764
- C:\Users\Admin\AppData\Local\Temp\1342d58b2a1dfddc7e4fcb61a47b5b46.exe
  C:\Users\Admin\AppData\Local\Temp\1342d58b2a1dfddc7e4fcb61a47b5b46.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:1076

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\1342d58b2a1dfddc7e4fcb61a47b5b46.exe

Filesize
832KB

MD5
24c44de131ed45d229ec54d8641de774

SHA1
a0a65353a3867291ba14a9e46b7b0718ab94a8dc

SHA256
0699c24fe41faa046d958d07389fe8d1be7df663494d94af95a2655c5b422381

SHA512
7f549d8f04f978342a5aac24b84ce3a78561ebc0b7bf071b8ef28b687ebecbf93bd5955df32f8cb0bdd4dccfe2f32d622279cabe121cfc82ea6c6b017510d0a4

Download Submit
\Users\Admin\AppData\Local\Temp\1342d58b2a1dfddc7e4fcb61a47b5b46.exe

Filesize
630KB

MD5
8ca34bfec77627ceb615be1e47912f93

SHA1
cdc6bd93d85d7d083cb31807ca643e04c6a42c38

SHA256
d00b50aba98c81065b17086f82c04338b21df5deeec6acc645d610ffdd525164

SHA512
ddf3da36ae8ad11f3f91db1b2a938a6792a79b52c88e8c4d07c862529ee3e50cc79cfc30ff873902b0c61b1e7db518aeee30a207e76fd2137fc51403aedc3d69

Download Submit
memory/1076-17-0x0000000000400000-0x00000000005F2000-memory.dmp

Filesize
1.9MB

Download
memory/1076-21-0x0000000000130000-0x0000000000242000-memory.dmp

Filesize
1.1MB

Download
memory/1076-19-0x0000000000400000-0x000000000086A000-memory.dmp

Filesize
4.4MB

Download
memory/1076-26-0x0000000000400000-0x000000000086A000-memory.dmp

Filesize
4.4MB

Download
memory/1764-0-0x0000000000400000-0x000000000086A000-memory.dmp

Filesize
4.4MB

Download
memory/1764-1-0x0000000000290000-0x00000000003A2000-memory.dmp

Filesize
1.1MB

Download
memory/1764-2-0x0000000000400000-0x00000000005F2000-memory.dmp

Filesize
1.9MB

Download
memory/1764-14-0x0000000000400000-0x00000000005F2000-memory.dmp

Filesize
1.9MB

Download
memory/1764-16-0x0000000003D20000-0x000000000418A000-memory.dmp

Filesize
4.4MB

Download