Overview

overview

7

Static

static

7

28f2ec2a7e...44.exe

windows7-x64

7

28f2ec2a7e...44.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    142s
  • max time network
    275s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    31/12/2023, 04:53

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    28f2ec2a7e8ccc1e0429227499c15644.exe

  • Size

    5.1MB

  • MD5

    28f2ec2a7e8ccc1e0429227499c15644

  • SHA1

    99e183d6efb0232b13d1cead9ac44cc25a220c0d

  • SHA256

    05ade7c9ec417adddc7adad841880661a88dc63ba6efa464f9b4453329bb9bb8

  • SHA512

    deac1793b02b0f80fd08710b497d405763e28f78f4a9786ae7aab927cf8836625f405e3051c08cad6daf79aa0ebbe048e056c57de5317ef8c706c4fed5480515

  • SSDEEP

    49152:Q6nZ1EAF1uIXFa7/rkGFXYifz7R2ySQZHttMay3rClb/nvTZG5uRqh0gI3QxNm/N:nnbaYw6ySsE3rClznvOuScAfIqm3

Score
7/10
upx

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\28f2ec2a7e8ccc1e0429227499c15644.exe
    "C:\Users\Admin\AppData\Local\Temp\28f2ec2a7e8ccc1e0429227499c15644.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: RenamesItself
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:2076
    • C:\Users\Admin\AppData\Local\Temp\28f2ec2a7e8ccc1e0429227499c15644.exe
      C:\Users\Admin\AppData\Local\Temp\28f2ec2a7e8ccc1e0429227499c15644.exe
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Suspicious use of UnmapMainImage
      PID:2044

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\28f2ec2a7e8ccc1e0429227499c15644.exe
          Filesize

          57KB

          MD5

          e389dea3524e09a93bbcfdee50034bda

          SHA1

          2f6a3dbe4296ab653d5708163ff4d94f1c217c63

          SHA256

          0d0688cb30c509fc66cbc8c296ed9b3390d06f9fd1dbff8299d49e612ba68087

          SHA512

          65497d0b6cc24ec4df01177168c65514b743d0cddca69b2c09d43700442a5038a6ab0e7ebc2b85c61a84e6c53402a87a1efed00b2f9c1c8ca97a53f7eae8dc46

          Download Submit

        • \Users\Admin\AppData\Local\Temp\28f2ec2a7e8ccc1e0429227499c15644.exe
          Filesize

          896KB

          MD5

          b75a52dee596b41e062cb1f3503d676d

          SHA1

          6d6c723cac981caa7b31228d6d5b0c85ce7e4054

          SHA256

          87dbbbe634fabf9fb2bda3e9252b780056274d9c3362e4420d36718805cfe191

          SHA512

          b44eaef0a6fb2d9d20c95f79472aef5abce7db76743a3695c560e23bece1013e6bbd3184a84e15fa80cd0bb078fca62e2b0d3763add2a9f50f9eddcb9aaf2c43

          Download Submit

        • memory/2044-17-0x0000000000400000-0x0000000000D9E000-memory.dmp

          Filesize

          9.6MB

          Download

        • memory/2044-20-0x00000000021F0000-0x000000000244A000-memory.dmp

          Filesize

          2.4MB

          Download

        • memory/2044-24-0x0000000000400000-0x0000000000D9E000-memory.dmp

          Filesize

          9.6MB

          Download

        • memory/2076-0-0x0000000000400000-0x0000000000D9E000-memory.dmp

          Filesize

          9.6MB

          Download

        • memory/2076-1-0x0000000001FA0000-0x00000000021FA000-memory.dmp

          Filesize

          2.4MB

          Download

        • memory/2076-2-0x0000000000400000-0x0000000000605000-memory.dmp

          Filesize

          2.0MB

          Download

        • memory/2076-15-0x0000000000400000-0x0000000000D9E000-memory.dmp

          Filesize

          9.6MB

          Download