b0a4c18db8e3539f6e150c050854ed86e33273ad98460e47833f76406b439d2c

Analysis

max time kernel
122s
max time network
129s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 21:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1cac53798cd6b249b766690101ad8545.exe
Size

5.3MB
MD5

1cac53798cd6b249b766690101ad8545
SHA1

39c92ed7c078faa3ed7fbbaf8fc79c5b902f57ac
SHA256

b0a4c18db8e3539f6e150c050854ed86e33273ad98460e47833f76406b439d2c
SHA512

a0f6b77bb1729b48e881eb646f6d790f2dd22f16a8d546bbe76e2767eace5e32ef281c8af219e3d04ceec5bbb2c2725e61c7af739169945cfe0d0771bd831f4b
SSDEEP

98304:2hC9TQkNbGxfDl8uCjp29PywSpJ40rDwANl28uCjp2p:AfkNw9CFmSnMa0CFI

Score

7^/10

upx

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2696	1cac53798cd6b249b766690101ad8545.exe

Executes dropped EXE 1 IoCs

pid	Process
2696	1cac53798cd6b249b766690101ad8545.exe

Loads dropped DLL 1 IoCs

pid	Process
1724	1cac53798cd6b249b766690101ad8545.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1724-0-0x0000000000400000-0x00000000008EF000-memory.dmp	upx
behavioral1/files/0x000a000000014615-10.dat	upx
behavioral1/files/0x000a000000014615-14.dat	upx
behavioral1/memory/2696-17-0x0000000000400000-0x00000000008EF000-memory.dmp	upx

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1724	1cac53798cd6b249b766690101ad8545.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
1724	1cac53798cd6b249b766690101ad8545.exe
2696	1cac53798cd6b249b766690101ad8545.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1724 wrote to memory of 2696	1724	1cac53798cd6b249b766690101ad8545.exe	28
PID 1724 wrote to memory of 2696	1724	1cac53798cd6b249b766690101ad8545.exe	28
PID 1724 wrote to memory of 2696	1724	1cac53798cd6b249b766690101ad8545.exe	28
PID 1724 wrote to memory of 2696	1724	1cac53798cd6b249b766690101ad8545.exe	28

C:\Users\Admin\AppData\Local\Temp\1cac53798cd6b249b766690101ad8545.exe
"C:\Users\Admin\AppData\Local\Temp\1cac53798cd6b249b766690101ad8545.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1724
- C:\Users\Admin\AppData\Local\Temp\1cac53798cd6b249b766690101ad8545.exe
  C:\Users\Admin\AppData\Local\Temp\1cac53798cd6b249b766690101ad8545.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:2696

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\1cac53798cd6b249b766690101ad8545.exe

Filesize
789KB

MD5
07c738edd1961826461071c1bbf6cf39

SHA1
2688f35370a0dcdf9bd5e36c23f492257f404b12

SHA256
bcb0264c58211049a1c2240d9e9e659388e00f8ecd6e47172f681338a4672878

SHA512
9452a723975e6bcf8d9f6ca1176e2df19a4e662b104fb4bf3b7b52675880a8131c6057085e2bbe848666fd55f044afcb7672bd40040187b02765420cf346967d

Download Submit
\Users\Admin\AppData\Local\Temp\1cac53798cd6b249b766690101ad8545.exe

Filesize
44KB

MD5
64d2569bff9c09e82d596fc60d6aae63

SHA1
8b2714f31228de5ec26fbcb6b2ce48bb9a7467f8

SHA256
83c7fafac19f418631590c8ff49bd92e3b0b43b006da4d55c031bbda0915a2bd

SHA512
9fe4998fac4a0f70c46b39be99509ce489b9fb92155fad608160b13a818ee7f7aa40a1d75405c80de2f59d87492871f997fed083f94023d407dce15e67a6485d

Download Submit
memory/1724-15-0x0000000003B90000-0x000000000407F000-memory.dmp

Filesize
4.9MB

Download
memory/1724-1-0x00000000002B0000-0x00000000003E3000-memory.dmp

Filesize
1.2MB

Download
memory/1724-13-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/1724-2-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/1724-0-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/2696-17-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/2696-19-0x0000000001B20000-0x0000000001C53000-memory.dmp

Filesize
1.2MB

Download
memory/2696-16-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/2696-23-0x0000000000400000-0x000000000061D000-memory.dmp

Filesize
2.1MB

Download
memory/2696-25-0x00000000035A0000-0x00000000037CA000-memory.dmp

Filesize
2.2MB

Download
memory/2696-31-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download