316fb35895a8bf18ff32f64be5172027eb68c542c389552eac1ded592531e017

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
06-01-2024 00:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

44d7b1933860afd78422c9480e1cb7d7.exe
Size

2.9MB
MD5

44d7b1933860afd78422c9480e1cb7d7
SHA1

d318427fc446a5a203573dac682fa36662d1500e
SHA256

316fb35895a8bf18ff32f64be5172027eb68c542c389552eac1ded592531e017
SHA512

ce2969dd894f4da167513bd278e6d272df2a1b095a237137ce234c3862f2e005d63f320328f58f25de965f755a1afa7a9e30974dfe95e8277e204ea281407ae6
SSDEEP

49152:cewStwnqvcLwJyXiv7yIo0VUl/fwpqzekIBzUBsDeyFcuSrJV:cSwnp6yuzSlApqz8lfSD

Score

7^/10

upx

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2192	44d7b1933860afd78422c9480e1cb7d7.exe

Executes dropped EXE 1 IoCs

pid	Process
2192	44d7b1933860afd78422c9480e1cb7d7.exe

Loads dropped DLL 1 IoCs

pid	Process
2652	44d7b1933860afd78422c9480e1cb7d7.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2652-0-0x0000000000400000-0x00000000008EF000-memory.dmp	upx
behavioral1/files/0x000a000000012243-10.dat	upx
behavioral1/files/0x000a000000012243-15.dat	upx

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2652	44d7b1933860afd78422c9480e1cb7d7.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2652	44d7b1933860afd78422c9480e1cb7d7.exe
2192	44d7b1933860afd78422c9480e1cb7d7.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2652 wrote to memory of 2192	2652	44d7b1933860afd78422c9480e1cb7d7.exe	28
PID 2652 wrote to memory of 2192	2652	44d7b1933860afd78422c9480e1cb7d7.exe	28
PID 2652 wrote to memory of 2192	2652	44d7b1933860afd78422c9480e1cb7d7.exe	28
PID 2652 wrote to memory of 2192	2652	44d7b1933860afd78422c9480e1cb7d7.exe	28

C:\Users\Admin\AppData\Local\Temp\44d7b1933860afd78422c9480e1cb7d7.exe
"C:\Users\Admin\AppData\Local\Temp\44d7b1933860afd78422c9480e1cb7d7.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2652
- C:\Users\Admin\AppData\Local\Temp\44d7b1933860afd78422c9480e1cb7d7.exe
  C:\Users\Admin\AppData\Local\Temp\44d7b1933860afd78422c9480e1cb7d7.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:2192

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\44d7b1933860afd78422c9480e1cb7d7.exe

Filesize
119KB

MD5
beb3da3e370ecae46b5ae2e49bf8db21

SHA1
6bb02fe7ae83a7f5c217121b5a635208c508b21c

SHA256
0ad61420615a9cd99d24237a57e9d925f690073fe6308841f2b3fcfccccf6476

SHA512
716f863e99556f768c53f6ad80b6f6ce888f6a7df56ffa249125f498f0b614e6b65b2df3782d14356e160672d6087f9e6f8d3cf7e85f85a1f3b1b1326b42af82

Download Submit
\Users\Admin\AppData\Local\Temp\44d7b1933860afd78422c9480e1cb7d7.exe

Filesize
322KB

MD5
d155b563d596eefa41a934971b6e9ff7

SHA1
bcc154090ec9bcb452e52189322cba6b283c4274

SHA256
f597cde83be37e6fdc1c71d1db351c31c973e9d61dc1936258b4a2eff87259de

SHA512
e2326213d5c303857614432bf0d9a579b286cb3c008202d9b3d89f3a9ecf857a978aaff9df69d03671233375332e0a6b545bd5be9421f11e743eaf99906e517d

Download Submit
memory/2192-16-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/2192-17-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/2192-19-0x0000000001B20000-0x0000000001C53000-memory.dmp

Filesize
1.2MB

Download
memory/2192-23-0x0000000000400000-0x000000000061D000-memory.dmp

Filesize
2.1MB

Download
memory/2192-25-0x0000000003410000-0x000000000363A000-memory.dmp

Filesize
2.2MB

Download
memory/2192-31-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/2652-2-0x0000000000130000-0x0000000000263000-memory.dmp

Filesize
1.2MB

Download
memory/2652-1-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/2652-0-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/2652-14-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/2652-13-0x00000000037F0000-0x0000000003CDF000-memory.dmp

Filesize
4.9MB

Download