26a9cded46627c18285ccbe2dbf61123e10aea8368843a12c2e2b127921bc1c2

Analysis

max time kernel
118s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
08/01/2024, 01:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4a3bbe4e17922c17ffb1fe5c2b48245a.exe
Size

2.7MB
MD5

4a3bbe4e17922c17ffb1fe5c2b48245a
SHA1

bb22e3f32b79d8f04aad2821baea22ed1b5100c6
SHA256

26a9cded46627c18285ccbe2dbf61123e10aea8368843a12c2e2b127921bc1c2
SHA512

dc4dcdce8222004192523a8cabebf9e2f3a6ffb51e2cd0ae46aa1634fd47239978b1136768041eb79c9bd3acf75515f0b8dbf177210c4c559c0a8532dd98fe93
SSDEEP

49152:bSfzrw2K/MJparPUP+fEqxVJOh65MnREsdgR9Y5kAa1ApF14MEK/CILCVLZ9s6Bb:bigfmpM8Py7YRnusdgHY41Ar14MEK/C1

Score

7^/10

upx

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2292	4a3bbe4e17922c17ffb1fe5c2b48245a.exe

Executes dropped EXE 1 IoCs

pid	Process
2292	4a3bbe4e17922c17ffb1fe5c2b48245a.exe

Loads dropped DLL 1 IoCs

pid	Process
2900	4a3bbe4e17922c17ffb1fe5c2b48245a.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2900-0-0x0000000000400000-0x00000000008E7000-memory.dmp	upx
behavioral1/files/0x000a000000012243-15.dat	upx
behavioral1/memory/2292-16-0x0000000000400000-0x00000000008E7000-memory.dmp	upx
behavioral1/memory/2900-13-0x0000000003760000-0x0000000003C47000-memory.dmp	upx

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2900	4a3bbe4e17922c17ffb1fe5c2b48245a.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2900	4a3bbe4e17922c17ffb1fe5c2b48245a.exe
2292	4a3bbe4e17922c17ffb1fe5c2b48245a.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2900 wrote to memory of 2292	2900	4a3bbe4e17922c17ffb1fe5c2b48245a.exe	16
PID 2900 wrote to memory of 2292	2900	4a3bbe4e17922c17ffb1fe5c2b48245a.exe	16
PID 2900 wrote to memory of 2292	2900	4a3bbe4e17922c17ffb1fe5c2b48245a.exe	16
PID 2900 wrote to memory of 2292	2900	4a3bbe4e17922c17ffb1fe5c2b48245a.exe	16

C:\Users\Admin\AppData\Local\Temp\4a3bbe4e17922c17ffb1fe5c2b48245a.exe
"C:\Users\Admin\AppData\Local\Temp\4a3bbe4e17922c17ffb1fe5c2b48245a.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2900
- C:\Users\Admin\AppData\Local\Temp\4a3bbe4e17922c17ffb1fe5c2b48245a.exe
  C:\Users\Admin\AppData\Local\Temp\4a3bbe4e17922c17ffb1fe5c2b48245a.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:2292

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\4a3bbe4e17922c17ffb1fe5c2b48245a.exe

Filesize
1KB

MD5
2efbc94c705b0f1d533be2c2a5286fae

SHA1
99277d2b9ed86f9a90df69900cd03750d6591cd8

SHA256
3a42a11c69b5dc709743dff62c3fa493d40fe6202f7bb33b0848d148e00445ae

SHA512
6c340898422f25848772b51872ae0cab408b7ecbb103dc805a2211c8d3f8a2ed50d55b404470955db404f1976384c1834ccc156c2c4bae5fde7cabb76d7f3470

Download Submit
memory/2292-24-0x00000000032B0000-0x00000000034D2000-memory.dmp

Filesize
2.1MB

Download
memory/2292-18-0x00000000002B0000-0x00000000003E1000-memory.dmp

Filesize
1.2MB

Download
memory/2292-16-0x0000000000400000-0x00000000008E7000-memory.dmp

Filesize
4.9MB

Download
memory/2292-23-0x0000000000400000-0x0000000000616000-memory.dmp

Filesize
2.1MB

Download
memory/2292-17-0x0000000000400000-0x0000000000622000-memory.dmp

Filesize
2.1MB

Download
memory/2292-32-0x0000000000400000-0x00000000008E7000-memory.dmp

Filesize
4.9MB

Download
memory/2900-0-0x0000000000400000-0x00000000008E7000-memory.dmp

Filesize
4.9MB

Download
memory/2900-3-0x0000000001B10000-0x0000000001C41000-memory.dmp

Filesize
1.2MB

Download
memory/2900-1-0x0000000000400000-0x0000000000622000-memory.dmp

Filesize
2.1MB

Download
memory/2900-14-0x0000000000400000-0x0000000000622000-memory.dmp

Filesize
2.1MB

Download
memory/2900-13-0x0000000003760000-0x0000000003C47000-memory.dmp

Filesize
4.9MB

Download
memory/2900-31-0x0000000003760000-0x0000000003C47000-memory.dmp

Filesize
4.9MB

Download