f92e76c6607293c3bc5b5b511b41ea5d5e774f85eaeb838e20a14fd2774089f5

Analysis

max time kernel
122s
max time network
128s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
01-01-2024 13:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3d0153bf70383995c8a07a2c3c86e1e3.exe
Size

2.9MB
MD5

3d0153bf70383995c8a07a2c3c86e1e3
SHA1

f99b974044d9c97f094513757e39c2c037272cdf
SHA256

f92e76c6607293c3bc5b5b511b41ea5d5e774f85eaeb838e20a14fd2774089f5
SHA512

2e5630794d83ea9ab89411f4a9c601de4e3363372baee2f8ccff09626a212c89877c70b47d2c1665d26714c095984956746c8275f45ef7a15a47038751520c61
SSDEEP

49152:DT/9UgzGm5SMoicucIbqMnf0Qd6Lf9zrJlQMur0Vd0cIT3AH:u6SJiVPpdkf9RlM4633q

Score

7^/10

upx

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2992	3d0153bf70383995c8a07a2c3c86e1e3.exe

Executes dropped EXE 1 IoCs

pid	Process
2992	3d0153bf70383995c8a07a2c3c86e1e3.exe

Loads dropped DLL 1 IoCs

pid	Process
2368	3d0153bf70383995c8a07a2c3c86e1e3.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2368-0-0x0000000000400000-0x00000000008EF000-memory.dmp	upx
behavioral1/files/0x000a0000000133a9-10.dat	upx
behavioral1/files/0x000a0000000133a9-13.dat	upx

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2368	3d0153bf70383995c8a07a2c3c86e1e3.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2368	3d0153bf70383995c8a07a2c3c86e1e3.exe
2992	3d0153bf70383995c8a07a2c3c86e1e3.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2368 wrote to memory of 2992	2368	3d0153bf70383995c8a07a2c3c86e1e3.exe	28
PID 2368 wrote to memory of 2992	2368	3d0153bf70383995c8a07a2c3c86e1e3.exe	28
PID 2368 wrote to memory of 2992	2368	3d0153bf70383995c8a07a2c3c86e1e3.exe	28
PID 2368 wrote to memory of 2992	2368	3d0153bf70383995c8a07a2c3c86e1e3.exe	28

C:\Users\Admin\AppData\Local\Temp\3d0153bf70383995c8a07a2c3c86e1e3.exe
"C:\Users\Admin\AppData\Local\Temp\3d0153bf70383995c8a07a2c3c86e1e3.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2368
- C:\Users\Admin\AppData\Local\Temp\3d0153bf70383995c8a07a2c3c86e1e3.exe
  C:\Users\Admin\AppData\Local\Temp\3d0153bf70383995c8a07a2c3c86e1e3.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:2992

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\3d0153bf70383995c8a07a2c3c86e1e3.exe

Filesize
92KB

MD5
ba8c685ceb7a52ddacb0a0bd47d51b3e

SHA1
da5f30bfb97d705f7c1b255c6ecec11e40634f90

SHA256
df34d8ece5b3cdd0fa9ae65bb3c6317c6ffca2306b0abf29d13a9e4162d867c4

SHA512
0e19144e681e89f9a113a0a287426d3ad6199bcb6cda8596ca763d1c6115d3f532fedb18482e38e57a900092eacf53d03f2b088b7cc89035d9bda9a88045c354

Download Submit
\Users\Admin\AppData\Local\Temp\3d0153bf70383995c8a07a2c3c86e1e3.exe

Filesize
382KB

MD5
6c38aeb33068f86e4b0e38515424984a

SHA1
af8c4b5b66b1c884ae67ca31e6a5212d635afbe0

SHA256
13f35eea8778eeb2d7b395f166337e2cc6fdf76abeec601383d23b81d84d7783

SHA512
ead899668f7c56d683a3980759567eb6785108c8940db98f2bb3d59919b389bfbe099dae52ebd1bc9c8da0f888d46a724842b92e72fa00238217278b49610ef1

Download Submit
memory/2368-0-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/2368-1-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/2368-2-0x0000000001B20000-0x0000000001C53000-memory.dmp

Filesize
1.2MB

Download
memory/2368-14-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/2992-17-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/2992-22-0x0000000000400000-0x000000000061D000-memory.dmp

Filesize
2.1MB

Download
memory/2992-25-0x0000000003410000-0x000000000363A000-memory.dmp

Filesize
2.2MB

Download
memory/2992-16-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/2992-15-0x0000000001B20000-0x0000000001C53000-memory.dmp

Filesize
1.2MB

Download
memory/2992-30-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download