bc0f4bd0bdd8148776e96d369e12436ce4b8828a3bb60c3b9eb082ba662c19bd

Analysis

max time kernel
120s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
04/01/2024, 11:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

40cb4cecad3e64f0f099d4dc888534b1.exe
Size

2.9MB
MD5

40cb4cecad3e64f0f099d4dc888534b1
SHA1

7ffa75834dbb6447d8c4d58c7a1cae578e486ba7
SHA256

bc0f4bd0bdd8148776e96d369e12436ce4b8828a3bb60c3b9eb082ba662c19bd
SHA512

ed7d4106e5098d1ceb6478e61d30506791e6ae5c4fdc2acd22ee63bad2d834d10f5a339a4713d8a6f27eee73c9d194977780ce26911b155cb1d6b264730fe2c6
SSDEEP

49152:fRHeTQKP6bSKBNbk1jErYc2WzryMhpxQqbrsI8OFP4M338dB2IBlGuuDVUsdxxjl:ftmP65BNCjEkc/z2tVPOFgg3gnl/IVU8

Score

7^/10

upx

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2644	40cb4cecad3e64f0f099d4dc888534b1.exe

Executes dropped EXE 1 IoCs

pid	Process
2644	40cb4cecad3e64f0f099d4dc888534b1.exe

Loads dropped DLL 1 IoCs

pid	Process
1016	40cb4cecad3e64f0f099d4dc888534b1.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1016-1-0x0000000000400000-0x00000000008EF000-memory.dmp	upx
behavioral1/files/0x000b000000012262-10.dat	upx
behavioral1/memory/2644-17-0x0000000000400000-0x00000000008EF000-memory.dmp	upx
behavioral1/files/0x000b000000012262-14.dat	upx

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1016	40cb4cecad3e64f0f099d4dc888534b1.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
1016	40cb4cecad3e64f0f099d4dc888534b1.exe
2644	40cb4cecad3e64f0f099d4dc888534b1.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1016 wrote to memory of 2644	1016	40cb4cecad3e64f0f099d4dc888534b1.exe	28
PID 1016 wrote to memory of 2644	1016	40cb4cecad3e64f0f099d4dc888534b1.exe	28
PID 1016 wrote to memory of 2644	1016	40cb4cecad3e64f0f099d4dc888534b1.exe	28
PID 1016 wrote to memory of 2644	1016	40cb4cecad3e64f0f099d4dc888534b1.exe	28

C:\Users\Admin\AppData\Local\Temp\40cb4cecad3e64f0f099d4dc888534b1.exe
"C:\Users\Admin\AppData\Local\Temp\40cb4cecad3e64f0f099d4dc888534b1.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1016
- C:\Users\Admin\AppData\Local\Temp\40cb4cecad3e64f0f099d4dc888534b1.exe
  C:\Users\Admin\AppData\Local\Temp\40cb4cecad3e64f0f099d4dc888534b1.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:2644

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\40cb4cecad3e64f0f099d4dc888534b1.exe

Filesize
1.5MB

MD5
e4cd6a19625ff68d3ef43463b11d45d8

SHA1
3bc055eb3eccaca33790f542c3b4375d6c6929d5

SHA256
01cc766ca75999e03eb8c8fb0bb971272dbef2b646e940f6f7edc0bbdbc80b38

SHA512
5519b6f4d09a17cea9fe03692c8f52e29f09649c7ecdd758bb1ee948a9691ccc63238cfb61bc6cea32e0e26e444d1b7f37b0adfa011d38eb9ab4e70f7e94d737

Download Submit
\Users\Admin\AppData\Local\Temp\40cb4cecad3e64f0f099d4dc888534b1.exe

Filesize
400KB

MD5
fdcf1d360e21d349eec7f0e56f7ef0d4

SHA1
45a09c7002b77a78855cd9b1c363fb7a2cd1e4a7

SHA256
9cffaabd043115bc9944070489d53720d28dba5694ccf1e48fb081c2e0aec81e

SHA512
ee7c4b0cdb3503512c1549b283811db7a3228132cc289f278a21613f43553e87cd817920ecc483ba9b3a828f098d66f8a0266fb5efb766f33954ca5d88f82166

Download Submit
memory/1016-3-0x0000000001B20000-0x0000000001C53000-memory.dmp

Filesize
1.2MB

Download
memory/1016-1-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/1016-15-0x00000000037F0000-0x0000000003CDF000-memory.dmp

Filesize
4.9MB

Download
memory/1016-16-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/1016-0-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/2644-17-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/2644-19-0x0000000001B20000-0x0000000001C53000-memory.dmp

Filesize
1.2MB

Download
memory/2644-18-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/2644-26-0x0000000003410000-0x000000000363A000-memory.dmp

Filesize
2.2MB

Download
memory/2644-24-0x0000000000400000-0x000000000061D000-memory.dmp

Filesize
2.1MB

Download
memory/2644-32-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download