5f29d81b9c210b4ca81bf2d7be7b3bb004fa1076068767479a3f705763939efd

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30-12-2023 10:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

168177d3b5f07ec5df7c0e4ebeffa87d.exe
Size

2.9MB
MD5

168177d3b5f07ec5df7c0e4ebeffa87d
SHA1

a54977665cf7d9bb679912c0fc47c8a3d888638e
SHA256

5f29d81b9c210b4ca81bf2d7be7b3bb004fa1076068767479a3f705763939efd
SHA512

40b1f2f45350ef239b868264fe7a1a1cc84e3d0a7d2f679dff29bf9461c8500b63fa03225d71b827a503fb7735158cb70b89c603cb73474400582bb8aea2f04a
SSDEEP

49152:ytUZvh9zM2ohwYI1HoI+U/XwqqQpSokV/UPJKwzQaD1a/D+dJd/DJt:Rhod4H0OgNQARV/URKhyphDJt

Score

7^/10

upx

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
808	168177d3b5f07ec5df7c0e4ebeffa87d.exe

Executes dropped EXE 1 IoCs

pid	Process
808	168177d3b5f07ec5df7c0e4ebeffa87d.exe

Loads dropped DLL 1 IoCs

pid	Process
2088	168177d3b5f07ec5df7c0e4ebeffa87d.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2088-1-0x0000000000400000-0x00000000008EF000-memory.dmp	upx
behavioral1/files/0x000c00000001224c-13.dat	upx
behavioral1/files/0x000c00000001224c-10.dat	upx

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2088	168177d3b5f07ec5df7c0e4ebeffa87d.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2088	168177d3b5f07ec5df7c0e4ebeffa87d.exe
808	168177d3b5f07ec5df7c0e4ebeffa87d.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2088 wrote to memory of 808	2088	168177d3b5f07ec5df7c0e4ebeffa87d.exe	28
PID 2088 wrote to memory of 808	2088	168177d3b5f07ec5df7c0e4ebeffa87d.exe	28
PID 2088 wrote to memory of 808	2088	168177d3b5f07ec5df7c0e4ebeffa87d.exe	28
PID 2088 wrote to memory of 808	2088	168177d3b5f07ec5df7c0e4ebeffa87d.exe	28

C:\Users\Admin\AppData\Local\Temp\168177d3b5f07ec5df7c0e4ebeffa87d.exe
"C:\Users\Admin\AppData\Local\Temp\168177d3b5f07ec5df7c0e4ebeffa87d.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2088
- C:\Users\Admin\AppData\Local\Temp\168177d3b5f07ec5df7c0e4ebeffa87d.exe
  C:\Users\Admin\AppData\Local\Temp\168177d3b5f07ec5df7c0e4ebeffa87d.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:808

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\168177d3b5f07ec5df7c0e4ebeffa87d.exe

Filesize
897KB

MD5
2078cf8e9f69da562cad3334a7f9a822

SHA1
ecb19887335e3d0ebc2a12fe9e1b48868201c7cf

SHA256
7575a072a4ab7032ca75cf8c362f1f877800664eb97a0fae5baaf27afaa4a815

SHA512
3179673a9a0408dc1010802264214e92cc9164cd475a015cc7363272b0a1a1029e7c1371f67a1f6097e23ab80aa7a6f145f760d2c3734d0fa93aeca460ce250f

Download Submit
\Users\Admin\AppData\Local\Temp\168177d3b5f07ec5df7c0e4ebeffa87d.exe

Filesize
900KB

MD5
8d25e716a02c95bc449f790ead89fc16

SHA1
6525158d41b3dbeb6b20ddf7b3540729306c3b3f

SHA256
7c72d25bfbaf76217984fa60816dae06088fd784c1447164031aa465736de5f7

SHA512
ab7b17996bfc1f4cd3c44f209704260a764f86f25468122d541109cdb87ae761f3bd86c495fbb18f54eaafb643a8fc66c75e94377809031346e1f66f4bcbf121

Download Submit
memory/808-17-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/808-22-0x0000000000400000-0x000000000061D000-memory.dmp

Filesize
2.1MB

Download
memory/808-24-0x0000000003530000-0x000000000375A000-memory.dmp

Filesize
2.2MB

Download
memory/808-16-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/808-15-0x00000000002A0000-0x00000000003D3000-memory.dmp

Filesize
1.2MB

Download
memory/808-30-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/2088-1-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/2088-0-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/2088-3-0x0000000000130000-0x0000000000263000-memory.dmp

Filesize
1.2MB

Download
memory/2088-14-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download