89b6954bd3d8cfeeea40b7a22dfe8b183aa0c7fe4b9950f219b2488e7962b0ec

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 13:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1ac1714caca6c2009500fdc2eacbad59.exe
Size

5.3MB
MD5

1ac1714caca6c2009500fdc2eacbad59
SHA1

6527b9f43762aca5361e5a0c5f6cfeabb18e619e
SHA256

89b6954bd3d8cfeeea40b7a22dfe8b183aa0c7fe4b9950f219b2488e7962b0ec
SHA512

c96125da421c9f7adf8e65b718606c23a9945b17b20ddd88a797fd36d2c6b5d6d3b3456e0b94e129b8885a6fc7bf6fd0a7eae511f56cd03ec48652eacdda90fd
SSDEEP

98304:+FdZH/+/R/Pintur6tvy1aMUvzp+umg+piur6tvy1aMUp:w+/R/Pnr6oEMyor6oEMe

Score

7^/10

upx

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3008	1ac1714caca6c2009500fdc2eacbad59.exe

Executes dropped EXE 1 IoCs

pid	Process
3008	1ac1714caca6c2009500fdc2eacbad59.exe

Loads dropped DLL 1 IoCs

pid	Process
1884	1ac1714caca6c2009500fdc2eacbad59.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1884-0-0x0000000000400000-0x00000000008EF000-memory.dmp	upx
behavioral1/files/0x000a00000001650c-13.dat	upx
behavioral1/memory/3008-17-0x0000000000400000-0x00000000008EF000-memory.dmp	upx
behavioral1/files/0x000a00000001650c-10.dat	upx

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1884	1ac1714caca6c2009500fdc2eacbad59.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
1884	1ac1714caca6c2009500fdc2eacbad59.exe
3008	1ac1714caca6c2009500fdc2eacbad59.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1884 wrote to memory of 3008	1884	1ac1714caca6c2009500fdc2eacbad59.exe	18
PID 1884 wrote to memory of 3008	1884	1ac1714caca6c2009500fdc2eacbad59.exe	18
PID 1884 wrote to memory of 3008	1884	1ac1714caca6c2009500fdc2eacbad59.exe	18
PID 1884 wrote to memory of 3008	1884	1ac1714caca6c2009500fdc2eacbad59.exe	18

C:\Users\Admin\AppData\Local\Temp\1ac1714caca6c2009500fdc2eacbad59.exe
"C:\Users\Admin\AppData\Local\Temp\1ac1714caca6c2009500fdc2eacbad59.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1884
- C:\Users\Admin\AppData\Local\Temp\1ac1714caca6c2009500fdc2eacbad59.exe
  C:\Users\Admin\AppData\Local\Temp\1ac1714caca6c2009500fdc2eacbad59.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:3008

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\1ac1714caca6c2009500fdc2eacbad59.exe

Filesize
92KB

MD5
fd14cff1f423951b6db6bc8ccd1934e0

SHA1
b7979bc23c2effd17bc905c42b98d4454ba6b5ba

SHA256
701519f6957490115619705235a1688fbf700316cdcc9338e4715c8558d18c4e

SHA512
ef92aa518ed995baf79e28d416ac1c0db9dad648ff7c45aaecc14bb583c6c6c498c7eeea5db5b1b5d79c89225a3e6af83f31b3ebb03f0b029680117b7cd12c13

Download Submit
memory/1884-15-0x0000000003DF0000-0x00000000042DF000-memory.dmp

Filesize
4.9MB

Download
memory/1884-2-0x00000000002A0000-0x00000000003D3000-memory.dmp

Filesize
1.2MB

Download
memory/1884-1-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/1884-14-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/1884-31-0x0000000003DF0000-0x00000000042DF000-memory.dmp

Filesize
4.9MB

Download
memory/1884-0-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/3008-17-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/3008-23-0x0000000000400000-0x000000000061D000-memory.dmp

Filesize
2.1MB

Download
memory/3008-25-0x0000000003680000-0x00000000038AA000-memory.dmp

Filesize
2.2MB

Download
memory/3008-16-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/3008-19-0x0000000000260000-0x0000000000393000-memory.dmp

Filesize
1.2MB

Download
memory/3008-32-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download