93fe9b5a7302dae331722857138e20f17fbe5af31c4466a9ac0b6400d3a2e807

Analysis

max time kernel
117s
max time network
131s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31-12-2023 00:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2185cc277bc269ca14a597462510bcb7.exe
Size

5.8MB
MD5

2185cc277bc269ca14a597462510bcb7
SHA1

423aee88889b426e225f97c5fd99b71b09ca352b
SHA256

93fe9b5a7302dae331722857138e20f17fbe5af31c4466a9ac0b6400d3a2e807
SHA512

5b200c27c85279c1a4db79b29ef1bd60e0bcfdd0dd9263f4b7ef2539337856b1e8685b060426e0c70fb358084867fba0521bd8f5e265d35b5b4d9f78d610bf8f
SSDEEP

98304:Eqc0eQjUX9q5qjgg3gnl/IVUs1jePsqthvHrFHa7a1gg3gnl/IVUs1jePs:EqxeHz5gl/iBiPftLIagl/iBiP

Score

7^/10

upx

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2424	2185cc277bc269ca14a597462510bcb7.exe

Executes dropped EXE 1 IoCs

pid	Process
2424	2185cc277bc269ca14a597462510bcb7.exe

Loads dropped DLL 1 IoCs

pid	Process
2172	2185cc277bc269ca14a597462510bcb7.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2172-0-0x0000000000400000-0x00000000008EF000-memory.dmp	upx
behavioral1/files/0x0009000000012232-10.dat	upx
behavioral1/files/0x0009000000012232-14.dat	upx
behavioral1/memory/2424-16-0x0000000000400000-0x00000000008EF000-memory.dmp	upx

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2172	2185cc277bc269ca14a597462510bcb7.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2172	2185cc277bc269ca14a597462510bcb7.exe
2424	2185cc277bc269ca14a597462510bcb7.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2172 wrote to memory of 2424	2172	2185cc277bc269ca14a597462510bcb7.exe	28
PID 2172 wrote to memory of 2424	2172	2185cc277bc269ca14a597462510bcb7.exe	28
PID 2172 wrote to memory of 2424	2172	2185cc277bc269ca14a597462510bcb7.exe	28
PID 2172 wrote to memory of 2424	2172	2185cc277bc269ca14a597462510bcb7.exe	28

C:\Users\Admin\AppData\Local\Temp\2185cc277bc269ca14a597462510bcb7.exe
"C:\Users\Admin\AppData\Local\Temp\2185cc277bc269ca14a597462510bcb7.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2172
- C:\Users\Admin\AppData\Local\Temp\2185cc277bc269ca14a597462510bcb7.exe
  C:\Users\Admin\AppData\Local\Temp\2185cc277bc269ca14a597462510bcb7.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:2424

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\2185cc277bc269ca14a597462510bcb7.exe

Filesize
2.1MB

MD5
56893022362d86c1613311660c28a713

SHA1
17ab366b173f3a94ca28ac269b45c5d333553fe4

SHA256
5d181d5d8366a7c584474e71ebe3ed53f8d83abbea23e2733a36b999d772ea92

SHA512
0072f0356a3023eb92ee3e08dc1dc235be4c386492e30efc5174078efbeed7a8ab066752e46aefdfb145ff5b6e60c4c74c3eee97826eb0d8d46603522add87fd

Download Submit
\Users\Admin\AppData\Local\Temp\2185cc277bc269ca14a597462510bcb7.exe

Filesize
2.0MB

MD5
1e5b9ecb954b7d8ed9c00f052000d3c9

SHA1
007f35a46d43ae3289cac13ae0d6596fe380a80d

SHA256
0fa7ac089d3b4ba9bc42d27535ca46e1b648a3fd641c3f11377b744c19372f2b

SHA512
d853240e06a52bd6afc9aa930ee187d7e360e31025c16c25c03c22040443d6df12769d34fef981ba04feec45fdbb8752d7610340a9956baac9a8abc781df6bb0

Download Submit
memory/2172-2-0x0000000001B20000-0x0000000001C53000-memory.dmp

Filesize
1.2MB

Download
memory/2172-0-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/2172-13-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/2172-15-0x0000000003DD0000-0x00000000042BF000-memory.dmp

Filesize
4.9MB

Download
memory/2172-1-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/2172-31-0x0000000003DD0000-0x00000000042BF000-memory.dmp

Filesize
4.9MB

Download
memory/2424-16-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/2424-18-0x0000000000240000-0x0000000000373000-memory.dmp

Filesize
1.2MB

Download
memory/2424-17-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/2424-23-0x0000000000400000-0x000000000061D000-memory.dmp

Filesize
2.1MB

Download
memory/2424-25-0x00000000034D0000-0x00000000036FA000-memory.dmp

Filesize
2.2MB

Download
memory/2424-32-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download