bd40d9d726d1fb2ee273810048c8efa47f875ae8697b6661728a51b045b54066

Analysis

max time kernel
117s
max time network
129s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
09/01/2024, 19:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4f0654e8239ba325e5d3c1c1939153cf.exe
Size

1.3MB
MD5

4f0654e8239ba325e5d3c1c1939153cf
SHA1

364592b9c52d752881b5bf1984261df7dc0765c2
SHA256

bd40d9d726d1fb2ee273810048c8efa47f875ae8697b6661728a51b045b54066
SHA512

26dbcb42f9336929eebe87c02119ac77d4384f81d3c375f462780d609dede1210bb99c812237e877d8de0c66b9233eda78c2e71c8ea0aa065f3cc0b2d0d1109c
SSDEEP

24576:WRwqMvplG4fEgOoCvfqq+JEQiKADKTOiXQC25KvTp9hoUYU9/9Us:Dx0eEgrm/+JADniXIuV9hoQR9j

Score

7^/10

upx

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1984	4f0654e8239ba325e5d3c1c1939153cf.exe

Executes dropped EXE 1 IoCs

pid	Process
1984	4f0654e8239ba325e5d3c1c1939153cf.exe

Loads dropped DLL 1 IoCs

pid	Process
1888	4f0654e8239ba325e5d3c1c1939153cf.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1888-0-0x0000000000400000-0x00000000008E7000-memory.dmp	upx
behavioral1/files/0x000e000000012247-14.dat	upx
behavioral1/memory/1984-16-0x0000000000400000-0x00000000008E7000-memory.dmp	upx

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1888	4f0654e8239ba325e5d3c1c1939153cf.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
1888	4f0654e8239ba325e5d3c1c1939153cf.exe
1984	4f0654e8239ba325e5d3c1c1939153cf.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1888 wrote to memory of 1984	1888	4f0654e8239ba325e5d3c1c1939153cf.exe	28
PID 1888 wrote to memory of 1984	1888	4f0654e8239ba325e5d3c1c1939153cf.exe	28
PID 1888 wrote to memory of 1984	1888	4f0654e8239ba325e5d3c1c1939153cf.exe	28
PID 1888 wrote to memory of 1984	1888	4f0654e8239ba325e5d3c1c1939153cf.exe	28

C:\Users\Admin\AppData\Local\Temp\4f0654e8239ba325e5d3c1c1939153cf.exe
"C:\Users\Admin\AppData\Local\Temp\4f0654e8239ba325e5d3c1c1939153cf.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1888
- C:\Users\Admin\AppData\Local\Temp\4f0654e8239ba325e5d3c1c1939153cf.exe
  C:\Users\Admin\AppData\Local\Temp\4f0654e8239ba325e5d3c1c1939153cf.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:1984

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\4f0654e8239ba325e5d3c1c1939153cf.exe

Filesize
1.3MB

MD5
fd8af8d809d03de5679251eb46e72314

SHA1
06c7e88eff17f278fddab2458b184169a28a9249

SHA256
aabe421b5ea24be194888ae169addf8d6eacc01fe717aee1b1ebb9329e4b2d54

SHA512
6246b04ff40c5777917c9d80e195fd89058964f31febb9069b81f595161907c54e398bf58bb96c2d70fe9ac64cdcb8bf13eceb36c6f454511a47a6bdcc3d77fe

Download Submit
memory/1888-31-0x00000000034E0000-0x00000000039C7000-memory.dmp

Filesize
4.9MB

Download
memory/1888-2-0x0000000000130000-0x0000000000261000-memory.dmp

Filesize
1.2MB

Download
memory/1888-1-0x0000000000400000-0x0000000000622000-memory.dmp

Filesize
2.1MB

Download
memory/1888-13-0x0000000000400000-0x0000000000622000-memory.dmp

Filesize
2.1MB

Download
memory/1888-15-0x00000000034E0000-0x00000000039C7000-memory.dmp

Filesize
4.9MB

Download
memory/1888-0-0x0000000000400000-0x00000000008E7000-memory.dmp

Filesize
4.9MB

Download
memory/1984-16-0x0000000000400000-0x00000000008E7000-memory.dmp

Filesize
4.9MB

Download
memory/1984-18-0x0000000000400000-0x0000000000622000-memory.dmp

Filesize
2.1MB

Download
memory/1984-23-0x0000000000400000-0x0000000000616000-memory.dmp

Filesize
2.1MB

Download
memory/1984-24-0x00000000032B0000-0x00000000034D2000-memory.dmp

Filesize
2.1MB

Download
memory/1984-17-0x00000000002B0000-0x00000000003E1000-memory.dmp

Filesize
1.2MB

Download
memory/1984-32-0x0000000000400000-0x00000000008E7000-memory.dmp

Filesize
4.9MB

Download