9f3ecaeac8bae7c4e01a3e84e4d4d754b7b6f1920911bea65e7325faa76de078

Analysis

max time kernel
163s
max time network
178s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
09/01/2024, 13:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4e7c541d76152a9c82d5769860970018.exe
Size

1.4MB
MD5

4e7c541d76152a9c82d5769860970018
SHA1

1d0a791492c042502172a0d48d926e75587d411e
SHA256

9f3ecaeac8bae7c4e01a3e84e4d4d754b7b6f1920911bea65e7325faa76de078
SHA512

54d582b3e3932bcb8c52728cb2cd4284577696cbddcf07a570a6ca536808ca0b9af5fa0187dcf15769e36c3920c0bd0d032bd657210683bae78bf8f8debf02ce
SSDEEP

24576:S6yJMY9UFoRDhkeYM1jJR97zUbia9JVe0hs5WfBiERJchVML1bT6E7:VY9UORVOM1jJHzaiape0hsABFRJch6Lv

Score

9^/10

rezer0 upx

Malware Config

Signatures

ReZer0 packer 1 IoCs

Detects ReZer0, a packer with multiple versions used in various campaigns.

rezer0

resource	yara_rule
behavioral2/memory/528-28-0x0000000006140000-0x000000000616C000-memory.dmp	rezer0

Executes dropped EXE 1 IoCs

pid	Process
528	test.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4436-0-0x0000000000400000-0x00000000006F1000-memory.dmp	upx
behavioral2/memory/4436-2-0x0000000000400000-0x00000000006F1000-memory.dmp	upx

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4436 wrote to memory of 4616	4436	4e7c541d76152a9c82d5769860970018.exe	91
PID 4436 wrote to memory of 4616	4436	4e7c541d76152a9c82d5769860970018.exe	91
PID 4436 wrote to memory of 4616	4436	4e7c541d76152a9c82d5769860970018.exe	91
PID 4616 wrote to memory of 528	4616	cmd.exe	95
PID 4616 wrote to memory of 528	4616	cmd.exe	95
PID 4616 wrote to memory of 528	4616	cmd.exe	95

C:\Users\Admin\AppData\Local\Temp\4e7c541d76152a9c82d5769860970018.exe
"C:\Users\Admin\AppData\Local\Temp\4e7c541d76152a9c82d5769860970018.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4436
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c test.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4616
- - C:\Users\Admin\AppData\Local\Temp\test.exe
    test.exe
    3⤵
    - Executes dropped EXE
    PID:528

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\test.exe

Filesize
330KB

MD5
261aa73f93c90dcec0c36a51cb9b5dee

SHA1
b0c41e06cd2ded81706820423db40bf8fea2c957

SHA256
ae160b749914bd56aecbcf43d56a59bde2069a145682b2911fe50c6adabe1b54

SHA512
7b90335b4a7db7b5056f6d60db642754038dc544bd2c1f82e68b1f8e339bf70227f0c08d157b4ca1004448fab7d109f0239196f242d0edeab978de9025a3c0ed

Download Submit
memory/528-14-0x00000000744C0000-0x0000000074C70000-memory.dmp

Filesize
7.7MB

Download
memory/528-8-0x00000000744C0000-0x0000000074C70000-memory.dmp

Filesize
7.7MB

Download
memory/528-11-0x0000000000A20000-0x0000000000A78000-memory.dmp

Filesize
352KB

Download
memory/528-13-0x00000000059A0000-0x0000000005F44000-memory.dmp

Filesize
5.6MB

Download
memory/528-16-0x0000000005710000-0x00000000057A2000-memory.dmp

Filesize
584KB

Download
memory/528-21-0x0000000005930000-0x0000000005940000-memory.dmp

Filesize
64KB

Download
memory/528-23-0x0000000001550000-0x000000000155A000-memory.dmp

Filesize
40KB

Download
memory/528-25-0x0000000001540000-0x0000000001548000-memory.dmp

Filesize
32KB

Download
memory/528-26-0x0000000005930000-0x0000000005940000-memory.dmp

Filesize
64KB

Download
memory/528-28-0x0000000006140000-0x000000000616C000-memory.dmp

Filesize
176KB

Download
memory/528-29-0x0000000006480000-0x000000000651C000-memory.dmp

Filesize
624KB

Download
memory/4436-2-0x0000000000400000-0x00000000006F1000-memory.dmp

Filesize
2.9MB

Download
memory/4436-0-0x0000000000400000-0x00000000006F1000-memory.dmp

Filesize
2.9MB

Download