0039de9eae9cfabf48aa1e0c66e16a44630153828a4fcda58cc093eb43d73398

Analysis

max time kernel
119s
max time network
141s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 02:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

256f1363eab1165012f4c00c08a6b145.exe
Size

2.9MB
MD5

256f1363eab1165012f4c00c08a6b145
SHA1

30a588a342e0cadb96a2343cf71d3dee05617080
SHA256

0039de9eae9cfabf48aa1e0c66e16a44630153828a4fcda58cc093eb43d73398
SHA512

b08b58cb2dc9e6e0cfc3f09523d72763af78da6f34f78dc6ed7a4c0877aa7c947b8d0ecbfa2b28262b6b9470e90ca25bc19b4ffcfb164ac4ddcb727d5f8ec13e
SSDEEP

49152:9XoZqGnKk2pBniIR+HAYoriP4M338dB2IBlGuuDVUsdxxjeQZwxPYRKs:94ZqK12pBnHsHAYorigg3gnl/IVUs1jl

Score

7^/10

upx

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2260	256f1363eab1165012f4c00c08a6b145.exe

Executes dropped EXE 1 IoCs

pid	Process
2260	256f1363eab1165012f4c00c08a6b145.exe

Loads dropped DLL 1 IoCs

pid	Process
1664	256f1363eab1165012f4c00c08a6b145.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1664-0-0x0000000000400000-0x00000000008EF000-memory.dmp	upx
behavioral1/files/0x0008000000012281-10.dat	upx
behavioral1/files/0x0008000000012281-15.dat	upx

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1664	256f1363eab1165012f4c00c08a6b145.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
1664	256f1363eab1165012f4c00c08a6b145.exe
2260	256f1363eab1165012f4c00c08a6b145.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1664 wrote to memory of 2260	1664	256f1363eab1165012f4c00c08a6b145.exe	28
PID 1664 wrote to memory of 2260	1664	256f1363eab1165012f4c00c08a6b145.exe	28
PID 1664 wrote to memory of 2260	1664	256f1363eab1165012f4c00c08a6b145.exe	28
PID 1664 wrote to memory of 2260	1664	256f1363eab1165012f4c00c08a6b145.exe	28

C:\Users\Admin\AppData\Local\Temp\256f1363eab1165012f4c00c08a6b145.exe
"C:\Users\Admin\AppData\Local\Temp\256f1363eab1165012f4c00c08a6b145.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1664
- C:\Users\Admin\AppData\Local\Temp\256f1363eab1165012f4c00c08a6b145.exe
  C:\Users\Admin\AppData\Local\Temp\256f1363eab1165012f4c00c08a6b145.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:2260

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\256f1363eab1165012f4c00c08a6b145.exe

Filesize
92KB

MD5
ef34dc4f8e0b86ed52644d8990f74465

SHA1
66a0f14ee9fdebcefc9250afa3bb0953b6a5d94a

SHA256
a84a8d9faa4438bc5046fc529e015985ec131fb6c7eb3194c5c26f358f9a5bd1

SHA512
061f2141822975ecacf51af7828514ca99e32cad977d32353c43f21a32d0c2d9226f6aa7658f70e9bdb9d8ebf6d4077383fb3584cb99cbc1e7139a7a9c87acda

Download Submit
\Users\Admin\AppData\Local\Temp\256f1363eab1165012f4c00c08a6b145.exe

Filesize
372KB

MD5
c3eb4e144a41e87ce5c19b074ba86469

SHA1
08cd688f05dac6ec22de71d830fadef08ff440d9

SHA256
8bc6319d565ad1b12ff68541e36ee74a0738f59f80c4fafba1bf3c83b1274d14

SHA512
d058d71873ede4186019c13e0aa9e1956439fa5e18fc73e9e01a5a4ecd2df73c9458e47b16459ce6c87c0b9f9e778f7ddea4bdd015635f1e6b4dca7fc59efc82

Download Submit
memory/1664-2-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/1664-0-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/1664-1-0x0000000000130000-0x0000000000263000-memory.dmp

Filesize
1.2MB

Download
memory/1664-14-0x00000000037E0000-0x0000000003CCF000-memory.dmp

Filesize
4.9MB

Download
memory/1664-13-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/1664-31-0x00000000037E0000-0x0000000003CCF000-memory.dmp

Filesize
4.9MB

Download
memory/2260-16-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/2260-17-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/2260-19-0x0000000001B20000-0x0000000001C53000-memory.dmp

Filesize
1.2MB

Download
memory/2260-23-0x0000000000400000-0x000000000061D000-memory.dmp

Filesize
2.1MB

Download
memory/2260-25-0x00000000035A0000-0x00000000037CA000-memory.dmp

Filesize
2.2MB

Download
memory/2260-32-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download