2410e835d44ad7b678a66734728a7266cfe36ec4249e3250243c28bcae6e85a8

Analysis

max time kernel
118s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 07:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2d47e50fa539a5beb41de427670a2832.exe
Size

2.7MB
MD5

2d47e50fa539a5beb41de427670a2832
SHA1

31541f8ffc5ec7d0a7594071c143aebafedc5f43
SHA256

2410e835d44ad7b678a66734728a7266cfe36ec4249e3250243c28bcae6e85a8
SHA512

60be5dc14ab465f93f997c430e8d85225f7eaec4f5d6d74abae8296f412154700f35668a1130260902a7318c6468070acf10996ccf281cd133f084d89196911e
SSDEEP

49152:uEJaPE6mBXpsEwyxES28R9cF5OonzWMnpMax+SW0IcWpAfejR9j:xaDm5pp1128HcFoLWT+SW0xWvHj

Score

7^/10

upx

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2204	2d47e50fa539a5beb41de427670a2832.exe

Executes dropped EXE 1 IoCs

pid	Process
2204	2d47e50fa539a5beb41de427670a2832.exe

Loads dropped DLL 1 IoCs

pid	Process
2484	2d47e50fa539a5beb41de427670a2832.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2484-0-0x0000000000400000-0x00000000008E7000-memory.dmp	upx
behavioral1/files/0x00050000000120fa-10.dat	upx
behavioral1/memory/2204-16-0x0000000000400000-0x00000000008E7000-memory.dmp	upx
behavioral1/files/0x00050000000120fa-14.dat	upx

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2484	2d47e50fa539a5beb41de427670a2832.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2484	2d47e50fa539a5beb41de427670a2832.exe
2204	2d47e50fa539a5beb41de427670a2832.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2484 wrote to memory of 2204	2484	2d47e50fa539a5beb41de427670a2832.exe	28
PID 2484 wrote to memory of 2204	2484	2d47e50fa539a5beb41de427670a2832.exe	28
PID 2484 wrote to memory of 2204	2484	2d47e50fa539a5beb41de427670a2832.exe	28
PID 2484 wrote to memory of 2204	2484	2d47e50fa539a5beb41de427670a2832.exe	28

C:\Users\Admin\AppData\Local\Temp\2d47e50fa539a5beb41de427670a2832.exe
"C:\Users\Admin\AppData\Local\Temp\2d47e50fa539a5beb41de427670a2832.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2484
- C:\Users\Admin\AppData\Local\Temp\2d47e50fa539a5beb41de427670a2832.exe
  C:\Users\Admin\AppData\Local\Temp\2d47e50fa539a5beb41de427670a2832.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:2204

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\2d47e50fa539a5beb41de427670a2832.exe

Filesize
347KB

MD5
b848a3cfa22b7bb95a2cbf70e7636187

SHA1
014b527735c64cf6d6b9b972fa99cc1b7557ca02

SHA256
5369f0d94428bd800e3aece451d83713074c031d9b1bc62574e78cd9534338cc

SHA512
42f677510c07ff0055927e3790469f39130127bf6dd8a12a603ae9a1cbca581a2a2b2ad613ca3b45da7abe885a6820f4f64e6e76384a4c95cedc0a84cd0d5eef

Download Submit
\Users\Admin\AppData\Local\Temp\2d47e50fa539a5beb41de427670a2832.exe

Filesize
386KB

MD5
a087b29b13f8e8f843153480e1a64570

SHA1
099fa3e5eefced4880d007dbb5a90dd685c8c0b0

SHA256
a735bd3d9be0ced9698b2bf8d565c5d3f3186bab355c343414f0b604674cfc31

SHA512
05b834d1bc6226619126acc387cb7eac54ff4d1f683cee175fbe3f2299e6f97984dd8cd02930f26b3d27b0d89b40ecad446792581b35a01c216ab74545c77504

Download Submit
memory/2204-18-0x0000000001B10000-0x0000000001C41000-memory.dmp

Filesize
1.2MB

Download
memory/2204-16-0x0000000000400000-0x00000000008E7000-memory.dmp

Filesize
4.9MB

Download
memory/2204-17-0x0000000000400000-0x0000000000622000-memory.dmp

Filesize
2.1MB

Download
memory/2204-24-0x00000000033F0000-0x0000000003612000-memory.dmp

Filesize
2.1MB

Download
memory/2204-23-0x0000000000400000-0x0000000000616000-memory.dmp

Filesize
2.1MB

Download
memory/2204-31-0x0000000000400000-0x00000000008E7000-memory.dmp

Filesize
4.9MB

Download
memory/2484-2-0x00000000002B0000-0x00000000003E1000-memory.dmp

Filesize
1.2MB

Download
memory/2484-13-0x0000000000400000-0x0000000000622000-memory.dmp

Filesize
2.1MB

Download
memory/2484-0-0x0000000000400000-0x00000000008E7000-memory.dmp

Filesize
4.9MB

Download
memory/2484-15-0x0000000003620000-0x0000000003B07000-memory.dmp

Filesize
4.9MB

Download
memory/2484-1-0x0000000000400000-0x0000000000622000-memory.dmp

Filesize
2.1MB

Download