7d18927bcef52cda21777c8a346159ceee3c7e1e423b83c1824bccfeed535301

Analysis

max time kernel
119s
max time network
144s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
01-01-2024 13:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3cf2935a35ee3dfa3405cfbab5160bf1.exe
Size

2.9MB
MD5

3cf2935a35ee3dfa3405cfbab5160bf1
SHA1

a4b005e4f0c12074b8e363ec7174b626e9c63c63
SHA256

7d18927bcef52cda21777c8a346159ceee3c7e1e423b83c1824bccfeed535301
SHA512

2079d40f16dc1ab8a8db32f862fd1ce6dd31b2dbb2088426ac1e3bac510332cd013a086de441805b06946ab47e26c2cdbe14fa3be75f378308aeeb3684f18d39
SSDEEP

49152:7AGrHo5AEF8rGvz9rS1IVUz8zAXKP4M338dB2IBlGuuDVUsdxxjeQZwxPYRKs:7zIVu42NXKgg3gnl/IVUs1jePs

Score

7^/10

upx

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2392	3cf2935a35ee3dfa3405cfbab5160bf1.exe

Executes dropped EXE 1 IoCs

pid	Process
2392	3cf2935a35ee3dfa3405cfbab5160bf1.exe

Loads dropped DLL 1 IoCs

pid	Process
2916	3cf2935a35ee3dfa3405cfbab5160bf1.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2916-0-0x0000000000400000-0x00000000008EF000-memory.dmp	upx
behavioral1/files/0x000800000001223a-10.dat	upx
behavioral1/files/0x000800000001223a-15.dat	upx
behavioral1/memory/2392-16-0x0000000000400000-0x00000000008EF000-memory.dmp	upx
behavioral1/memory/2916-13-0x00000000037F0000-0x0000000003CDF000-memory.dmp	upx

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2916	3cf2935a35ee3dfa3405cfbab5160bf1.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2916	3cf2935a35ee3dfa3405cfbab5160bf1.exe
2392	3cf2935a35ee3dfa3405cfbab5160bf1.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2916 wrote to memory of 2392	2916	3cf2935a35ee3dfa3405cfbab5160bf1.exe	27
PID 2916 wrote to memory of 2392	2916	3cf2935a35ee3dfa3405cfbab5160bf1.exe	27
PID 2916 wrote to memory of 2392	2916	3cf2935a35ee3dfa3405cfbab5160bf1.exe	27
PID 2916 wrote to memory of 2392	2916	3cf2935a35ee3dfa3405cfbab5160bf1.exe	27

C:\Users\Admin\AppData\Local\Temp\3cf2935a35ee3dfa3405cfbab5160bf1.exe
"C:\Users\Admin\AppData\Local\Temp\3cf2935a35ee3dfa3405cfbab5160bf1.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2916
- C:\Users\Admin\AppData\Local\Temp\3cf2935a35ee3dfa3405cfbab5160bf1.exe
  C:\Users\Admin\AppData\Local\Temp\3cf2935a35ee3dfa3405cfbab5160bf1.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:2392

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\3cf2935a35ee3dfa3405cfbab5160bf1.exe

Filesize
92KB

MD5
cd98b6a7db86ca987ab2536a34c718ad

SHA1
b18ee02132a0ce504970277728ab8ab4e043f37c

SHA256
47422ab324da53076737fc0b7a3120dbddb0643a9d6cc4441e2c6356263ecef5

SHA512
d5d78dec91fdbfc137cfcdaedfe03aa2639da9d77ed9ed721e3f471a59a2711dc3893d16244a432c452d1e20f63c15ebe72ec1292119b876b19a7d5f8d38bb71

Download Submit
memory/2392-19-0x0000000000250000-0x0000000000383000-memory.dmp

Filesize
1.2MB

Download
memory/2392-17-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/2392-16-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/2392-24-0x00000000034E0000-0x000000000370A000-memory.dmp

Filesize
2.2MB

Download
memory/2392-23-0x0000000000400000-0x000000000061D000-memory.dmp

Filesize
2.1MB

Download
memory/2392-32-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/2916-0-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/2916-2-0x0000000001B20000-0x0000000001C53000-memory.dmp

Filesize
1.2MB

Download
memory/2916-1-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/2916-14-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/2916-13-0x00000000037F0000-0x0000000003CDF000-memory.dmp

Filesize
4.9MB

Download
memory/2916-31-0x00000000037F0000-0x0000000003CDF000-memory.dmp

Filesize
4.9MB

Download