f2993b781e08ecc4dc808673804a64049de45d57a5d0af6f173236badf31521d

Analysis

max time kernel
33s
max time network
161s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
06/01/2024, 09:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

45e755057737c8be784120263eb87a2e.exe
Size

1.3MB
MD5

45e755057737c8be784120263eb87a2e
SHA1

dcb880ae29941813cfcbf2cea9addacbd5326c9f
SHA256

f2993b781e08ecc4dc808673804a64049de45d57a5d0af6f173236badf31521d
SHA512

922ac5728360d55a8fcb0988720b1f1c8e217f1ac76fe464aca899e7ab200866325ff69598096fa9d6ef8dcfba236f45b544315c9e477c67eedf0c9f86cb6a01
SSDEEP

24576:jExhD3s867/n4RNXzl1HTSxW46VGRqemGrBEPs/uDfioddJdCZvG:j2hD336UNptTS76wqemXPwumo9A

Score

7^/10

upx

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2532	45e755057737c8be784120263eb87a2e.exe

Executes dropped EXE 1 IoCs

pid	Process
2532	45e755057737c8be784120263eb87a2e.exe

Loads dropped DLL 1 IoCs

pid	Process
2672	45e755057737c8be784120263eb87a2e.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2672-0-0x0000000000400000-0x000000000086A000-memory.dmp	upx
behavioral1/files/0x000a000000012252-15.dat	upx
behavioral1/files/0x000a000000012252-11.dat	upx

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2672	45e755057737c8be784120263eb87a2e.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2672	45e755057737c8be784120263eb87a2e.exe
2532	45e755057737c8be784120263eb87a2e.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2672 wrote to memory of 2532	2672	45e755057737c8be784120263eb87a2e.exe	24
PID 2672 wrote to memory of 2532	2672	45e755057737c8be784120263eb87a2e.exe	24
PID 2672 wrote to memory of 2532	2672	45e755057737c8be784120263eb87a2e.exe	24
PID 2672 wrote to memory of 2532	2672	45e755057737c8be784120263eb87a2e.exe	24

C:\Users\Admin\AppData\Local\Temp\45e755057737c8be784120263eb87a2e.exe
"C:\Users\Admin\AppData\Local\Temp\45e755057737c8be784120263eb87a2e.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2672
- C:\Users\Admin\AppData\Local\Temp\45e755057737c8be784120263eb87a2e.exe
  C:\Users\Admin\AppData\Local\Temp\45e755057737c8be784120263eb87a2e.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:2532

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\45e755057737c8be784120263eb87a2e.exe

Filesize
260KB

MD5
3f1d64d2bc56e0f629347bb1e0dd9333

SHA1
7b257158df207c28e6333c2cfe217d08cbc294ce

SHA256
91c2450bf3c725bd1d831bfdde96637a99097bec8837bafaaba65912491b7009

SHA512
e369a9379936bf79cda54999473798be8b970e9a7bc8c267e0a07772fe91dc5ab8764dd3de56755647ce2e6fce0719434de0feed19abcead6f7ca557df34367f

Download Submit
\Users\Admin\AppData\Local\Temp\45e755057737c8be784120263eb87a2e.exe

Filesize
228KB

MD5
1f87c9627a888e06e8cb691f3db04662

SHA1
4d8b8d8219e0cdc9ca7a9fa8f27d0483d01a62d0

SHA256
473f286254e3833152493436fd8af3f6fe9af0185d52208efcf5586d7f5c3f0d

SHA512
a44a5898965dbcf89b065f484235a840227f1a310ba8d4fdb781da715aba429970b1aa07ef07c12ce62346971df00502b443c112fbfe372bd18e20d962c6509a

Download Submit
memory/2532-19-0x0000000000400000-0x00000000005F2000-memory.dmp

Filesize
1.9MB

Download
memory/2532-18-0x00000000002B0000-0x00000000003C2000-memory.dmp

Filesize
1.1MB

Download
memory/2532-27-0x0000000000400000-0x000000000086A000-memory.dmp

Filesize
4.4MB

Download
memory/2672-0-0x0000000000400000-0x000000000086A000-memory.dmp

Filesize
4.4MB

Download
memory/2672-2-0x0000000000400000-0x00000000005F2000-memory.dmp

Filesize
1.9MB

Download
memory/2672-1-0x0000000001A60000-0x0000000001B72000-memory.dmp

Filesize
1.1MB

Download
memory/2672-17-0x0000000000400000-0x00000000005F2000-memory.dmp

Filesize
1.9MB

Download
memory/2672-16-0x00000000033F0000-0x000000000385A000-memory.dmp

Filesize
4.4MB

Download
memory/2672-26-0x00000000033F0000-0x000000000385A000-memory.dmp

Filesize
4.4MB

Download