ef3757719e66196009f935b90bbddd6c4b5169f03e6b3eeaedfbd95bd8954ce8

Analysis

max time kernel
118s
max time network
125s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
31-12-2023 04:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

28f6fe9a116d3fb9f7a580e41c6d7ffd.exe
Size

2.7MB
MD5

28f6fe9a116d3fb9f7a580e41c6d7ffd
SHA1

93ed0f162631a07a466e41200f4ea86c28f27754
SHA256

ef3757719e66196009f935b90bbddd6c4b5169f03e6b3eeaedfbd95bd8954ce8
SHA512

ee31275bd49d2535b9f17dca7c797ba708077c29843b6f3e931830df225f4368252c021ac6ca275d0f71f88364bc9d0a3a849e34770037e56dc7748ba050cc01
SSDEEP

49152:uVBxq+tvvH0GT3dI+kL9xcIanMOR9TCXPF41HUVSUXp18Q8ZyGdCCC7mtqYSWcRt:+Bx7tvvvT3S+kLPcIxOHO/u10EUQTZtS

Score

7^/10

upx

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2780	28f6fe9a116d3fb9f7a580e41c6d7ffd.exe

Executes dropped EXE 1 IoCs

pid	Process
2780	28f6fe9a116d3fb9f7a580e41c6d7ffd.exe

Loads dropped DLL 1 IoCs

pid	Process
2240	28f6fe9a116d3fb9f7a580e41c6d7ffd.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2240-0-0x0000000000400000-0x00000000008E7000-memory.dmp	upx
behavioral1/files/0x000b0000000126ab-13.dat	upx
behavioral1/files/0x000b0000000126ab-10.dat	upx

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2240	28f6fe9a116d3fb9f7a580e41c6d7ffd.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2240	28f6fe9a116d3fb9f7a580e41c6d7ffd.exe
2780	28f6fe9a116d3fb9f7a580e41c6d7ffd.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2240 wrote to memory of 2780	2240	28f6fe9a116d3fb9f7a580e41c6d7ffd.exe	19
PID 2240 wrote to memory of 2780	2240	28f6fe9a116d3fb9f7a580e41c6d7ffd.exe	19
PID 2240 wrote to memory of 2780	2240	28f6fe9a116d3fb9f7a580e41c6d7ffd.exe	19
PID 2240 wrote to memory of 2780	2240	28f6fe9a116d3fb9f7a580e41c6d7ffd.exe	19

C:\Users\Admin\AppData\Local\Temp\28f6fe9a116d3fb9f7a580e41c6d7ffd.exe
"C:\Users\Admin\AppData\Local\Temp\28f6fe9a116d3fb9f7a580e41c6d7ffd.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2240
- C:\Users\Admin\AppData\Local\Temp\28f6fe9a116d3fb9f7a580e41c6d7ffd.exe
  C:\Users\Admin\AppData\Local\Temp\28f6fe9a116d3fb9f7a580e41c6d7ffd.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:2780

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\28f6fe9a116d3fb9f7a580e41c6d7ffd.exe

Filesize
98KB

MD5
ba75460c704733deabd9a1abded45406

SHA1
54d43b3c20b8fbcccb15df728fa249e1dd0ad47b

SHA256
d2127c76280b3beaac0f45bacf9b38ef7feae39b71b19129a5e08114a09fda03

SHA512
1c38bf279838f659592ee7c8e29c535205d5bc7118619df76c62b1e7cca4103b9abb0b81be277e254f5332a2504c4fc5fec4638f297b2754b99c4792ee904288

Download Submit
\Users\Admin\AppData\Local\Temp\28f6fe9a116d3fb9f7a580e41c6d7ffd.exe

Filesize
144KB

MD5
2085a67ef36b46852d1ac0c95aa2956a

SHA1
57b57369ade5eee7c5cdc74452d906ef8c41b9f5

SHA256
b3539cd389cd37dcc02f4fc05eada45119952f2a234f7c60fb4145f4db44ba19

SHA512
a9c306b0100d32aca7963cdaecfa9bdc97229f4b3af8e4b7d8f2bb9a85c15784517a18d526c2dc58b6a91a59ead43b3921070331703ed1698dc81baffc9cdcb1

Download Submit
memory/2240-15-0x0000000003760000-0x0000000003C47000-memory.dmp

Filesize
4.9MB

Download
memory/2240-14-0x0000000000400000-0x0000000000622000-memory.dmp

Filesize
2.1MB

Download
memory/2240-0-0x0000000000400000-0x00000000008E7000-memory.dmp

Filesize
4.9MB

Download
memory/2240-1-0x0000000000400000-0x0000000000622000-memory.dmp

Filesize
2.1MB

Download
memory/2240-2-0x0000000001B10000-0x0000000001C41000-memory.dmp

Filesize
1.2MB

Download
memory/2240-31-0x0000000003760000-0x0000000003C47000-memory.dmp

Filesize
4.9MB

Download
memory/2780-16-0x0000000000400000-0x0000000000622000-memory.dmp

Filesize
2.1MB

Download
memory/2780-23-0x0000000000400000-0x0000000000616000-memory.dmp

Filesize
2.1MB

Download
memory/2780-25-0x00000000033F0000-0x0000000003612000-memory.dmp

Filesize
2.1MB

Download
memory/2780-20-0x0000000001B10000-0x0000000001C41000-memory.dmp

Filesize
1.2MB

Download
memory/2780-18-0x0000000000400000-0x00000000008E7000-memory.dmp

Filesize
4.9MB

Download
memory/2780-32-0x0000000000400000-0x00000000008E7000-memory.dmp

Filesize
4.9MB

Download