8798bf7387eb73e12213c8139cb9dba3707df2725367f9a2d64637002a5c0a77

Analysis

max time kernel
3s
max time network
140s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
03/01/2024, 19:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3ee0ff7c3220865dc0bf21411a985811.exe
Size

2.6MB
MD5

3ee0ff7c3220865dc0bf21411a985811
SHA1

8c6e329552670729019c8716eabc4db3dbb62fca
SHA256

8798bf7387eb73e12213c8139cb9dba3707df2725367f9a2d64637002a5c0a77
SHA512

6ba6d1f012ef2c5fa23e7d436a5ba368453c1c4b73c421427ecd2e25b1906dd79b7125963b9f4ccbd9b5c1338d7d194b70a259fd1d48fbb18020dc7ad3f43279
SSDEEP

49152:o1AE/sqRGawVJZL9LLc+6swMJndOyf+GG20/C2hCOqwOAay3:IRGaaRfLz9vuaE3

Score

7^/10

upx

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
320	3ee0ff7c3220865dc0bf21411a985811.exe

Executes dropped EXE 1 IoCs

pid	Process
320	3ee0ff7c3220865dc0bf21411a985811.exe

Loads dropped DLL 1 IoCs

pid	Process
1680	3ee0ff7c3220865dc0bf21411a985811.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1680-1-0x0000000000400000-0x0000000000D9E000-memory.dmp	upx
behavioral1/files/0x0009000000015c46-15.dat	upx
behavioral1/files/0x0009000000015c46-11.dat	upx

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1680	3ee0ff7c3220865dc0bf21411a985811.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
1680	3ee0ff7c3220865dc0bf21411a985811.exe
320	3ee0ff7c3220865dc0bf21411a985811.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1680 wrote to memory of 320	1680	3ee0ff7c3220865dc0bf21411a985811.exe	17
PID 1680 wrote to memory of 320	1680	3ee0ff7c3220865dc0bf21411a985811.exe	17
PID 1680 wrote to memory of 320	1680	3ee0ff7c3220865dc0bf21411a985811.exe	17
PID 1680 wrote to memory of 320	1680	3ee0ff7c3220865dc0bf21411a985811.exe	17

C:\Users\Admin\AppData\Local\Temp\3ee0ff7c3220865dc0bf21411a985811.exe
"C:\Users\Admin\AppData\Local\Temp\3ee0ff7c3220865dc0bf21411a985811.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1680
- C:\Users\Admin\AppData\Local\Temp\3ee0ff7c3220865dc0bf21411a985811.exe
  C:\Users\Admin\AppData\Local\Temp\3ee0ff7c3220865dc0bf21411a985811.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:320

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\3ee0ff7c3220865dc0bf21411a985811.exe

Filesize
12KB

MD5
e7c59c3bfdc283bc4837e95e720f7519

SHA1
6e04adf723c0fb70495d0a2335e7c93880cf71cf

SHA256
f715e5a9f96f3f94c510b8b5f8263866372dd5a73dee90530fc2520ec7cfa112

SHA512
30cc3440bb8860a15d815f48bfb2c8936c063c724174c80cf322a4e8df371c37f67b2563fedcb24e322b5049d09ae1e6010dd1eed743bd70e2d2f2e5cd594c2a

Download Submit
\Users\Admin\AppData\Local\Temp\3ee0ff7c3220865dc0bf21411a985811.exe

Filesize
32KB

MD5
cdf24b892f47401904f4d77fd1ca00e9

SHA1
080c3ecc7b346a1a89ce4e89c3219f96846990a6

SHA256
181da6855a0e4f78614db8242064772efaff128f700b4f45b95ee2401833e717

SHA512
27ed006524e00e266094bd9b558fbf0179f61c495f4affc80471267d2ec0afc3980d6b8c7ab53805ef2b00d7202e5740abe0b7aaf7cb6c15d8f918beb5e1a091

Download Submit
memory/320-19-0x0000000000400000-0x0000000000D9E000-memory.dmp

Filesize
9.6MB

Download
memory/320-21-0x0000000001FA0000-0x00000000021FA000-memory.dmp

Filesize
2.4MB

Download
memory/320-34-0x0000000000400000-0x0000000000D9E000-memory.dmp

Filesize
9.6MB

Download
memory/1680-1-0x0000000000400000-0x0000000000D9E000-memory.dmp

Filesize
9.6MB

Download
memory/1680-3-0x0000000002220000-0x000000000247A000-memory.dmp

Filesize
2.4MB

Download
memory/1680-17-0x0000000003B20000-0x00000000044BE000-memory.dmp

Filesize
9.6MB

Download
memory/1680-14-0x0000000000400000-0x0000000000605000-memory.dmp

Filesize
2.0MB

Download
memory/1680-0-0x0000000000400000-0x0000000000605000-memory.dmp

Filesize
2.0MB

Download
memory/1680-33-0x0000000003B20000-0x00000000044BE000-memory.dmp

Filesize
9.6MB

Download