c837ca37f826b09a45b199c820da9260ab65018210a512c3abea2b5dba2c09be

Analysis

max time kernel
122s
max time network
133s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30-12-2023 09:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1462c4229ac1afc307b271c7a97fdb43.exe
Size

1.3MB
MD5

1462c4229ac1afc307b271c7a97fdb43
SHA1

1f15b0944ffaf67e1065940d6ec81fed9a686e51
SHA256

c837ca37f826b09a45b199c820da9260ab65018210a512c3abea2b5dba2c09be
SHA512

351b5a35f6e4ad0608ef868e4e753cc8c9dffc276992d8b30af0c438a3a940f5bbb95c8da09158d1810558b9cf6bd1c36127aab2ed7ea25346ea7ebf9ba4363a
SSDEEP

24576:F0Ni4rtiC+kOFiJ7SG2VmTx6P5PHOF3GMQD+nEWRbjiVahmWMQrJYKvCs1NOwPw8:FzC0iJ7SOcPpmGPanhiVaDlzqs18awUD

Score

7^/10

upx

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2388	1462c4229ac1afc307b271c7a97fdb43.exe

Executes dropped EXE 1 IoCs

pid	Process
2388	1462c4229ac1afc307b271c7a97fdb43.exe

Loads dropped DLL 1 IoCs

pid	Process
2356	1462c4229ac1afc307b271c7a97fdb43.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2356-0-0x0000000000400000-0x00000000008EF000-memory.dmp	upx
behavioral1/files/0x000b000000012185-10.dat	upx
behavioral1/memory/2388-17-0x0000000000400000-0x00000000008EF000-memory.dmp	upx

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2356	1462c4229ac1afc307b271c7a97fdb43.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2356	1462c4229ac1afc307b271c7a97fdb43.exe
2388	1462c4229ac1afc307b271c7a97fdb43.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2356 wrote to memory of 2388	2356	1462c4229ac1afc307b271c7a97fdb43.exe	28
PID 2356 wrote to memory of 2388	2356	1462c4229ac1afc307b271c7a97fdb43.exe	28
PID 2356 wrote to memory of 2388	2356	1462c4229ac1afc307b271c7a97fdb43.exe	28
PID 2356 wrote to memory of 2388	2356	1462c4229ac1afc307b271c7a97fdb43.exe	28

C:\Users\Admin\AppData\Local\Temp\1462c4229ac1afc307b271c7a97fdb43.exe
"C:\Users\Admin\AppData\Local\Temp\1462c4229ac1afc307b271c7a97fdb43.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2356
- C:\Users\Admin\AppData\Local\Temp\1462c4229ac1afc307b271c7a97fdb43.exe
  C:\Users\Admin\AppData\Local\Temp\1462c4229ac1afc307b271c7a97fdb43.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:2388

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\1462c4229ac1afc307b271c7a97fdb43.exe

Filesize
1.3MB

MD5
bd3a8f6e4251a7704f2674097da6537c

SHA1
749cb7c34fb5f3a76612487ddfee00b5bd3afba6

SHA256
77b9750f7388a3a727a100081a693bd8f78c8938e6a5b113e76c493f1b1ea235

SHA512
4a36359fc7c8b49c28f3ad05bf01e8f1d557f5e948d722ccb52cfd9b639195a2e3e841e8cec384504850f0f0405a931e9b6979b4bee0ab59d148d37759272168

Download Submit
memory/2356-31-0x00000000034E0000-0x00000000039CF000-memory.dmp

Filesize
4.9MB

Download
memory/2356-2-0x0000000000130000-0x0000000000263000-memory.dmp

Filesize
1.2MB

Download
memory/2356-1-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/2356-13-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/2356-15-0x00000000034E0000-0x00000000039CF000-memory.dmp

Filesize
4.9MB

Download
memory/2356-0-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/2388-17-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/2388-19-0x0000000001B20000-0x0000000001C53000-memory.dmp

Filesize
1.2MB

Download
memory/2388-24-0x0000000003410000-0x000000000363A000-memory.dmp

Filesize
2.2MB

Download
memory/2388-23-0x0000000000400000-0x000000000061D000-memory.dmp

Filesize
2.1MB

Download
memory/2388-16-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/2388-32-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download