f230080b8cec4c0b4ea0ad7fa7a76982da186808a2c832c9d5d4804b189f3e3f

Analysis

max time kernel
119s
max time network
160s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31-12-2023 03:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

26622874259ef76f8efe1b6fadcbc237.exe
Size

5.3MB
MD5

26622874259ef76f8efe1b6fadcbc237
SHA1

aa754625e31d3eb530ab7899640b28191bb295f9
SHA256

f230080b8cec4c0b4ea0ad7fa7a76982da186808a2c832c9d5d4804b189f3e3f
SHA512

d434a48e57cc8eb1e7eb745d5a91c0bd4f9e999f66afe199d5e1a7771889be88e715c84857f49572a636c54b1678dbcc8aa53c8305064d039647ec47d10a05fb
SSDEEP

98304:snFcCXi7RGgt5H6P2dVIqNaS/DCHGnATOwlQH8xH6P2dVIqNaS/DCHj:ITy7rXFWmATdCH8xXFWD

Score

7^/10

upx

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
368	26622874259ef76f8efe1b6fadcbc237.exe

Executes dropped EXE 1 IoCs

pid	Process
368	26622874259ef76f8efe1b6fadcbc237.exe

Loads dropped DLL 1 IoCs

pid	Process
1644	26622874259ef76f8efe1b6fadcbc237.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1644-1-0x0000000000400000-0x00000000008E7000-memory.dmp	upx
behavioral1/files/0x0003000000004ed5-15.dat	upx
behavioral1/memory/368-16-0x0000000000400000-0x00000000008E7000-memory.dmp	upx
behavioral1/files/0x0003000000004ed5-11.dat	upx

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1644	26622874259ef76f8efe1b6fadcbc237.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
1644	26622874259ef76f8efe1b6fadcbc237.exe
368	26622874259ef76f8efe1b6fadcbc237.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1644 wrote to memory of 368	1644	26622874259ef76f8efe1b6fadcbc237.exe	28
PID 1644 wrote to memory of 368	1644	26622874259ef76f8efe1b6fadcbc237.exe	28
PID 1644 wrote to memory of 368	1644	26622874259ef76f8efe1b6fadcbc237.exe	28
PID 1644 wrote to memory of 368	1644	26622874259ef76f8efe1b6fadcbc237.exe	28

C:\Users\Admin\AppData\Local\Temp\26622874259ef76f8efe1b6fadcbc237.exe
"C:\Users\Admin\AppData\Local\Temp\26622874259ef76f8efe1b6fadcbc237.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1644
- C:\Users\Admin\AppData\Local\Temp\26622874259ef76f8efe1b6fadcbc237.exe
  C:\Users\Admin\AppData\Local\Temp\26622874259ef76f8efe1b6fadcbc237.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:368

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\26622874259ef76f8efe1b6fadcbc237.exe

Filesize
1.1MB

MD5
c473fac7a35fb8d237d28c920ae0c349

SHA1
58bee0d6bacaafe6271b1f3a5fd79466c22abfc4

SHA256
4ae9b37804ec6a9b0909a5bf763e015ec8c1635ff23005d2a36bd7f47751341f

SHA512
586a8c6d01830055dcc337c2b72f75502a20158cada3b9a63a227bb2028292d43ab3a39007444a566f6321823a0b165c1500f1cd4895a92055c79e76e2351269

Download Submit
\Users\Admin\AppData\Local\Temp\26622874259ef76f8efe1b6fadcbc237.exe

Filesize
1.5MB

MD5
6721e0e973a697aa6e631656ed9f453d

SHA1
8abd7685575ed2678025e8b1e9c9e25d747370f2

SHA256
42d12662862c942ab58a9887dbf97868536c5eb3b6a5e4c9495ebfc795367381

SHA512
5df6cf353d69cc9a81a8c1c6ab1016ddb0e6244b23a37163311a250af88cf564194b7845bfdcbf4b7c7e2ed9c432d1d08dc8536decd4764311ba8de1a53c4320

Download Submit
memory/368-17-0x0000000001B10000-0x0000000001C41000-memory.dmp

Filesize
1.2MB

Download
memory/368-31-0x0000000000400000-0x00000000008E7000-memory.dmp

Filesize
4.9MB

Download
memory/368-28-0x00000000033F0000-0x0000000003612000-memory.dmp

Filesize
2.1MB

Download
memory/368-23-0x0000000000400000-0x0000000000616000-memory.dmp

Filesize
2.1MB

Download
memory/368-16-0x0000000000400000-0x00000000008E7000-memory.dmp

Filesize
4.9MB

Download
memory/368-18-0x0000000000400000-0x0000000000622000-memory.dmp

Filesize
2.1MB

Download
memory/1644-10-0x0000000000400000-0x00000000008E7000-memory.dmp

Filesize
4.9MB

Download
memory/1644-14-0x0000000000400000-0x0000000000622000-memory.dmp

Filesize
2.1MB

Download
memory/1644-0-0x0000000000400000-0x0000000000622000-memory.dmp

Filesize
2.1MB

Download
memory/1644-3-0x0000000001B10000-0x0000000001C41000-memory.dmp

Filesize
1.2MB

Download
memory/1644-1-0x0000000000400000-0x00000000008E7000-memory.dmp

Filesize
4.9MB

Download