e030bcf5411903e4f4cd9be577f2e2d3328b1626c99ffbfa85b3acec8b428d06

Analysis

max time kernel
119s
max time network
122s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
06/01/2024, 19:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4709c42fcb2a8ab1d29b2d34f7ba6eb3.exe
Size

3.9MB
MD5

4709c42fcb2a8ab1d29b2d34f7ba6eb3
SHA1

a1890f62f011bffe35087200d50a43acb8f802d1
SHA256

e030bcf5411903e4f4cd9be577f2e2d3328b1626c99ffbfa85b3acec8b428d06
SHA512

0d8493b50f170a98fdd7ac5c3bcb4022b866aa895cd96deafe926764cf8167656a9f9c83dfd245eae3cc01bb1502ca3e95be06709777158ff74e4c9b90d71510
SSDEEP

98304:SWzoM270Iig+OBwS0gg3gnl/IVUt4pJWzZtIygg3gnl/IVUV:SHpiVOBegl/iwgWttJgl/iG

Score

7^/10

upx

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2204	4709c42fcb2a8ab1d29b2d34f7ba6eb3.exe

Executes dropped EXE 1 IoCs

pid	Process
2204	4709c42fcb2a8ab1d29b2d34f7ba6eb3.exe

Loads dropped DLL 1 IoCs

pid	Process
2368	4709c42fcb2a8ab1d29b2d34f7ba6eb3.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2368-0-0x0000000000400000-0x00000000008EF000-memory.dmp	upx
behavioral1/files/0x0009000000014abe-15.dat	upx
behavioral1/memory/2204-16-0x0000000000400000-0x00000000008EF000-memory.dmp	upx
behavioral1/files/0x0009000000014abe-10.dat	upx

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2368	4709c42fcb2a8ab1d29b2d34f7ba6eb3.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2368	4709c42fcb2a8ab1d29b2d34f7ba6eb3.exe
2204	4709c42fcb2a8ab1d29b2d34f7ba6eb3.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2368 wrote to memory of 2204	2368	4709c42fcb2a8ab1d29b2d34f7ba6eb3.exe	28
PID 2368 wrote to memory of 2204	2368	4709c42fcb2a8ab1d29b2d34f7ba6eb3.exe	28
PID 2368 wrote to memory of 2204	2368	4709c42fcb2a8ab1d29b2d34f7ba6eb3.exe	28
PID 2368 wrote to memory of 2204	2368	4709c42fcb2a8ab1d29b2d34f7ba6eb3.exe	28

C:\Users\Admin\AppData\Local\Temp\4709c42fcb2a8ab1d29b2d34f7ba6eb3.exe
"C:\Users\Admin\AppData\Local\Temp\4709c42fcb2a8ab1d29b2d34f7ba6eb3.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2368
- C:\Users\Admin\AppData\Local\Temp\4709c42fcb2a8ab1d29b2d34f7ba6eb3.exe
  C:\Users\Admin\AppData\Local\Temp\4709c42fcb2a8ab1d29b2d34f7ba6eb3.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:2204

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\4709c42fcb2a8ab1d29b2d34f7ba6eb3.exe

Filesize
382KB

MD5
c20f595ebd1d937d42ec11ebcc6a8b84

SHA1
3f74474fae260a60b542f171429e8990751fdf2c

SHA256
6312832feed46999433a799fcccfcb4f34f45aec50cb8ea43cdf24abf7a9c81f

SHA512
5477cd219f3cb930dd7c1bc6b851cbe0710db1681c454f5911fec489cc69086283cda78e89bd138d885ef9ac6d0d82ea5cca92b13791154a18941cb5b2a5b7bc

Download Submit
\Users\Admin\AppData\Local\Temp\4709c42fcb2a8ab1d29b2d34f7ba6eb3.exe

Filesize
864KB

MD5
965dacc09f4658e2c63677d8125d13ff

SHA1
aa6a5ebe6a1a3b0fd0bf4c72227b426a9ddeaf63

SHA256
c29c3ba81db1e4e3c15f87218d46c13942aeedfca736f3c06826cede846aebba

SHA512
86cd3b4d5abad910ddb1ba63d392575600feb181101c9379d3e83999edd1fd96278f84ae01a198cd78a6824e1fa74c359534e77952bd7ae22882610cc9208e2a

Download Submit
memory/2204-16-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/2204-23-0x0000000000400000-0x000000000061D000-memory.dmp

Filesize
2.1MB

Download
memory/2204-19-0x0000000001B20000-0x0000000001C53000-memory.dmp

Filesize
1.2MB

Download
memory/2204-26-0x0000000003410000-0x000000000363A000-memory.dmp

Filesize
2.2MB

Download
memory/2204-17-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/2204-32-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/2368-14-0x0000000003AD0000-0x0000000003FBF000-memory.dmp

Filesize
4.9MB

Download
memory/2368-2-0x0000000000260000-0x0000000000393000-memory.dmp

Filesize
1.2MB

Download
memory/2368-0-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/2368-13-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/2368-1-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/2368-31-0x0000000003AD0000-0x0000000003FBF000-memory.dmp

Filesize
4.9MB

Download