f130f2af878bb0a67ed64c9d4bee50620765e87d77e813db616d307f6a240d62

Analysis

max time kernel
120s
max time network
129s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
07/01/2024, 08:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

487976ab2d454eba97d8ad70db3e8200.exe
Size

1.3MB
MD5

487976ab2d454eba97d8ad70db3e8200
SHA1

ccb3eefa90d253aac6c83034d94c4319c0a66cd6
SHA256

f130f2af878bb0a67ed64c9d4bee50620765e87d77e813db616d307f6a240d62
SHA512

40a343ab0d903d54543736aeeda020eb76ebfc11d14a6e2a9e276b1b2f7d093b26010cb4a8ae7857e9eeae204a38435e445b3fe7bd9de3faf013f793fc38f3ac
SSDEEP

24576:XoS+WKlCsWhsAGuRevBBN3HAQntVgwjVv0orYndmJRsqjM/LzZVB3wWc:XiCnPZePN33njgwjZ0WYndmJKqj8zPBy

Score

7^/10

upx

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2740	487976ab2d454eba97d8ad70db3e8200.exe

Executes dropped EXE 1 IoCs

pid	Process
2740	487976ab2d454eba97d8ad70db3e8200.exe

Loads dropped DLL 1 IoCs

pid	Process
2772	487976ab2d454eba97d8ad70db3e8200.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2772-0-0x0000000000400000-0x00000000008EF000-memory.dmp	upx
behavioral1/files/0x0008000000012232-12.dat	upx
behavioral1/memory/2740-16-0x0000000000400000-0x00000000008EF000-memory.dmp	upx

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2772	487976ab2d454eba97d8ad70db3e8200.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2772	487976ab2d454eba97d8ad70db3e8200.exe
2740	487976ab2d454eba97d8ad70db3e8200.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2772 wrote to memory of 2740	2772	487976ab2d454eba97d8ad70db3e8200.exe	28
PID 2772 wrote to memory of 2740	2772	487976ab2d454eba97d8ad70db3e8200.exe	28
PID 2772 wrote to memory of 2740	2772	487976ab2d454eba97d8ad70db3e8200.exe	28
PID 2772 wrote to memory of 2740	2772	487976ab2d454eba97d8ad70db3e8200.exe	28

C:\Users\Admin\AppData\Local\Temp\487976ab2d454eba97d8ad70db3e8200.exe
"C:\Users\Admin\AppData\Local\Temp\487976ab2d454eba97d8ad70db3e8200.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2772
- C:\Users\Admin\AppData\Local\Temp\487976ab2d454eba97d8ad70db3e8200.exe
  C:\Users\Admin\AppData\Local\Temp\487976ab2d454eba97d8ad70db3e8200.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:2740

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\487976ab2d454eba97d8ad70db3e8200.exe

Filesize
1.3MB

MD5
0099e686e6f69b378105eee6fa0da1aa

SHA1
040160f6474525ac878d76c27594db9f257af366

SHA256
32f1be6c305820de447dae9617f7eb43f787c838c14f766b3dc3ad02b3c9a647

SHA512
09f46565db576bb12a310e4ff9d47b43926af4c9f6b0cc603df05a4f68a89880d9d084b1c98b1564eafa07f821742c6c40f86a3ac59ac001a66f40a4c9cdf0ff

Download Submit
memory/2740-23-0x0000000000400000-0x000000000061D000-memory.dmp

Filesize
2.1MB

Download
memory/2740-16-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/2740-17-0x0000000001B20000-0x0000000001C53000-memory.dmp

Filesize
1.2MB

Download
memory/2740-18-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/2740-24-0x0000000003410000-0x000000000363A000-memory.dmp

Filesize
2.2MB

Download
memory/2740-32-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/2772-4-0x00000000018F0000-0x0000000001A23000-memory.dmp

Filesize
1.2MB

Download
memory/2772-13-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/2772-1-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/2772-14-0x0000000003620000-0x0000000003B0F000-memory.dmp

Filesize
4.9MB

Download
memory/2772-0-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/2772-31-0x0000000003620000-0x0000000003B0F000-memory.dmp

Filesize
4.9MB

Download