ab7404e362326c08a990dd3d411ef0a6812b8a88431aa207f4f9d330cd7eec0a

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
09/01/2024, 02:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4d232e2b58382e5a15693b298aa3a7c7.exe
Size

5.3MB
MD5

4d232e2b58382e5a15693b298aa3a7c7
SHA1

e40ea5b7b8013187b79bc433db6a1621b3b5ebe9
SHA256

ab7404e362326c08a990dd3d411ef0a6812b8a88431aa207f4f9d330cd7eec0a
SHA512

b313dcfbc0000f9fdf39fbfc3be600a5dc1b94dbe73d8a5493f26ab433dba0bd3001ed1581506efec36dc0532748dea971ebb4d6da59a219d4fd63709688cf63
SSDEEP

98304:PevJo6CpiGHCQCFqagNBBTt5+mzrbjzHiZmoiC8m3vaB1HCQCFqagNBBTt5+mzrv:Pe2/iGiQ0qakBR/zrbjz3N1qa1iQ0qaI

Score

7^/10

upx

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2716	4d232e2b58382e5a15693b298aa3a7c7.exe

Executes dropped EXE 1 IoCs

pid	Process
2716	4d232e2b58382e5a15693b298aa3a7c7.exe

Loads dropped DLL 1 IoCs

pid	Process
2332	4d232e2b58382e5a15693b298aa3a7c7.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2332-0-0x0000000000400000-0x00000000008E7000-memory.dmp	upx
behavioral1/files/0x000b00000001223f-10.dat	upx
behavioral1/memory/2716-17-0x0000000000400000-0x00000000008E7000-memory.dmp	upx
behavioral1/files/0x000b00000001223f-13.dat	upx

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2332	4d232e2b58382e5a15693b298aa3a7c7.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2332	4d232e2b58382e5a15693b298aa3a7c7.exe
2716	4d232e2b58382e5a15693b298aa3a7c7.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2332 wrote to memory of 2716	2332	4d232e2b58382e5a15693b298aa3a7c7.exe	22
PID 2332 wrote to memory of 2716	2332	4d232e2b58382e5a15693b298aa3a7c7.exe	22
PID 2332 wrote to memory of 2716	2332	4d232e2b58382e5a15693b298aa3a7c7.exe	22
PID 2332 wrote to memory of 2716	2332	4d232e2b58382e5a15693b298aa3a7c7.exe	22

C:\Users\Admin\AppData\Local\Temp\4d232e2b58382e5a15693b298aa3a7c7.exe
"C:\Users\Admin\AppData\Local\Temp\4d232e2b58382e5a15693b298aa3a7c7.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2332
- C:\Users\Admin\AppData\Local\Temp\4d232e2b58382e5a15693b298aa3a7c7.exe
  C:\Users\Admin\AppData\Local\Temp\4d232e2b58382e5a15693b298aa3a7c7.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:2716

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\4d232e2b58382e5a15693b298aa3a7c7.exe

Filesize
30KB

MD5
a57adea2838abab1175096d97e1351bb

SHA1
c63c9e61ae00be2cb67bcec6b703a43f7c5e2cac

SHA256
f0d6d4101e81ca2a7d666670cc9081a31e179a2a55ebca00e75db97c5cb92b1a

SHA512
fb914446774fbcc2835c3fc1dc3321aa77bc0c014f2d3b16e18c1b73a7c24b4619bb5b1c1e10d7b13bf6171d88f22aad12ebc88483a43fe36c56e51284c88cca

Download Submit
\Users\Admin\AppData\Local\Temp\4d232e2b58382e5a15693b298aa3a7c7.exe

Filesize
40KB

MD5
d5c79caec081fedaf157354bca359eec

SHA1
f15e75639d0ccfe754d315f54cdf1344223677dd

SHA256
6e0c96d1e6b0a69155649df9c6cabba0540364cb010ecd7222a255656cf74ecd

SHA512
56f12575ba089d59b00b70c73ca1e78b58ca3c7a0a53bda7da0277d7b8db0859c38d456b7c281cd803fef996c8f95f61d0805d56a7d6ad5d6e1614af0f1c3166

Download Submit
memory/2332-15-0x0000000000400000-0x0000000000622000-memory.dmp

Filesize
2.1MB

Download
memory/2332-0-0x0000000000400000-0x00000000008E7000-memory.dmp

Filesize
4.9MB

Download
memory/2332-3-0x0000000001B10000-0x0000000001C41000-memory.dmp

Filesize
1.2MB

Download
memory/2332-14-0x0000000003CA0000-0x0000000004187000-memory.dmp

Filesize
4.9MB

Download
memory/2332-1-0x0000000000400000-0x0000000000622000-memory.dmp

Filesize
2.1MB

Download
memory/2716-16-0x0000000000400000-0x0000000000622000-memory.dmp

Filesize
2.1MB

Download
memory/2716-17-0x0000000000400000-0x00000000008E7000-memory.dmp

Filesize
4.9MB

Download
memory/2716-20-0x0000000000130000-0x0000000000261000-memory.dmp

Filesize
1.2MB

Download
memory/2716-24-0x00000000033F0000-0x0000000003612000-memory.dmp

Filesize
2.1MB

Download
memory/2716-23-0x0000000000400000-0x0000000000616000-memory.dmp

Filesize
2.1MB

Download
memory/2716-31-0x0000000000400000-0x00000000008E7000-memory.dmp

Filesize
4.9MB

Download