6109c0c0c6ea059e0fef926cf7366abe2f11a1e7bff22556d445fde88c747298

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
05/01/2024, 01:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

426deeb82fedba748adf56b8df9b5566.exe
Size

1.3MB
MD5

426deeb82fedba748adf56b8df9b5566
SHA1

c21d5e333257f1cc298590ac57f14501a18ef98f
SHA256

6109c0c0c6ea059e0fef926cf7366abe2f11a1e7bff22556d445fde88c747298
SHA512

eb8b6ba969a3a0c62c4bcbfdafcc256249f249315d4f4e30fc96995c58d236b9b1b6d741bf7ceaf222a39a4872a4d3abeee40aac5fa310d5dc0d47d6e0980b1e
SSDEEP

24576:ICAtkGvd9zxnRfYerDHMjf+5jj9qT0Vo1is/lD0C8wn8AzKkIV9QNYRqKvG:C99FYePL9j9qwVoTD0Cn8AzTIPqkq

Score

7^/10

upx

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2592	426deeb82fedba748adf56b8df9b5566.exe

Executes dropped EXE 1 IoCs

pid	Process
2592	426deeb82fedba748adf56b8df9b5566.exe

Loads dropped DLL 1 IoCs

pid	Process
1680	426deeb82fedba748adf56b8df9b5566.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1680-0-0x0000000000400000-0x000000000086A000-memory.dmp	upx
behavioral1/files/0x000b0000000139e0-11.dat	upx
behavioral1/files/0x000b0000000139e0-15.dat	upx
behavioral1/memory/1680-17-0x00000000033F0000-0x000000000385A000-memory.dmp	upx

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1680	426deeb82fedba748adf56b8df9b5566.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
1680	426deeb82fedba748adf56b8df9b5566.exe
2592	426deeb82fedba748adf56b8df9b5566.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1680 wrote to memory of 2592	1680	426deeb82fedba748adf56b8df9b5566.exe	28
PID 1680 wrote to memory of 2592	1680	426deeb82fedba748adf56b8df9b5566.exe	28
PID 1680 wrote to memory of 2592	1680	426deeb82fedba748adf56b8df9b5566.exe	28
PID 1680 wrote to memory of 2592	1680	426deeb82fedba748adf56b8df9b5566.exe	28

C:\Users\Admin\AppData\Local\Temp\426deeb82fedba748adf56b8df9b5566.exe
"C:\Users\Admin\AppData\Local\Temp\426deeb82fedba748adf56b8df9b5566.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1680
- C:\Users\Admin\AppData\Local\Temp\426deeb82fedba748adf56b8df9b5566.exe
  C:\Users\Admin\AppData\Local\Temp\426deeb82fedba748adf56b8df9b5566.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:2592

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\426deeb82fedba748adf56b8df9b5566.exe

Filesize
257KB

MD5
25c0bd167e6a7207cd8d33b66e1d5a33

SHA1
705e553c21a30ff8c1e2fbdaac336b93fab4bcc5

SHA256
65084957847dc6e818d095ad5f7c9e1a362d8b2547d29aae312165d93e001e7b

SHA512
23dc6c24992b5bcc8142cf5110282587eda458a84aa001fb7c830d236a3a44e904f369d57011e93b856fe5bcfa5088338a4ad007899986edb171220f2e7ccddd

Download Submit
\Users\Admin\AppData\Local\Temp\426deeb82fedba748adf56b8df9b5566.exe

Filesize
316KB

MD5
90890aa44ddae24da7649114eb15b111

SHA1
8fc34e7c4bcbbae19f6a1db899f6fe37f2be81f9

SHA256
bbfe67869556609b678d7ba2ecc3c056d9def97a64199a98767f5ed06b63dde7

SHA512
1d7132794a538558d2f2698db5a94308d792199e85519495d41723562548b09a1cf2089f4f05863a74d28adf57cb8aac5800ec2db8d45e5db035985d241bee8d

Download Submit
memory/1680-0-0x0000000000400000-0x000000000086A000-memory.dmp

Filesize
4.4MB

Download
memory/1680-1-0x0000000001A60000-0x0000000001B72000-memory.dmp

Filesize
1.1MB

Download
memory/1680-2-0x0000000000400000-0x00000000005F2000-memory.dmp

Filesize
1.9MB

Download
memory/1680-14-0x0000000000400000-0x00000000005F2000-memory.dmp

Filesize
1.9MB

Download
memory/1680-17-0x00000000033F0000-0x000000000385A000-memory.dmp

Filesize
4.4MB

Download
memory/2592-16-0x0000000000400000-0x00000000005F2000-memory.dmp

Filesize
1.9MB

Download
memory/2592-20-0x0000000000400000-0x000000000086A000-memory.dmp

Filesize
4.4MB

Download
memory/2592-22-0x0000000001A60000-0x0000000001B72000-memory.dmp

Filesize
1.1MB

Download
memory/2592-26-0x0000000000400000-0x000000000086A000-memory.dmp

Filesize
4.4MB

Download