8b7d671edacc61bf970461dd0bf5b163a3fc2ae245b31c53ea0c23bd5f779af6

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
10-01-2024 17:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

51203fd7407ac61b8b27d27510b5710b.exe
Size

2.9MB
MD5

51203fd7407ac61b8b27d27510b5710b
SHA1

0ae8fed780bfc4379662b75ade59dd75462fcbea
SHA256

8b7d671edacc61bf970461dd0bf5b163a3fc2ae245b31c53ea0c23bd5f779af6
SHA512

0d57c1819a774a025ecf77ca6dc09331069c5a7cc8772e8e8e2cecb1ac6de4454986b22a8bad796a09d939d1c1f19dcf3207d9b0dd272f175d20b4d836918ad2
SSDEEP

49152:18YzD0HtxCsNH4xRWhv5AKG10jhdUxS8P4M338dB2IBlGuuDVUsdxxjeQZwxPYRr:eIDSoZxRi1y+hdUE8gg3gnl/IVUs1jek

Score

7^/10

upx

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2240	51203fd7407ac61b8b27d27510b5710b.exe

Executes dropped EXE 1 IoCs

pid	Process
2240	51203fd7407ac61b8b27d27510b5710b.exe

Loads dropped DLL 1 IoCs

pid	Process
2536	51203fd7407ac61b8b27d27510b5710b.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2536-0-0x0000000000400000-0x00000000008EF000-memory.dmp	upx
behavioral1/files/0x0008000000012254-10.dat	upx
behavioral1/files/0x0008000000012254-13.dat	upx

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2536	51203fd7407ac61b8b27d27510b5710b.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2536	51203fd7407ac61b8b27d27510b5710b.exe
2240	51203fd7407ac61b8b27d27510b5710b.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2536 wrote to memory of 2240	2536	51203fd7407ac61b8b27d27510b5710b.exe	28
PID 2536 wrote to memory of 2240	2536	51203fd7407ac61b8b27d27510b5710b.exe	28
PID 2536 wrote to memory of 2240	2536	51203fd7407ac61b8b27d27510b5710b.exe	28
PID 2536 wrote to memory of 2240	2536	51203fd7407ac61b8b27d27510b5710b.exe	28

C:\Users\Admin\AppData\Local\Temp\51203fd7407ac61b8b27d27510b5710b.exe
"C:\Users\Admin\AppData\Local\Temp\51203fd7407ac61b8b27d27510b5710b.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2536
- C:\Users\Admin\AppData\Local\Temp\51203fd7407ac61b8b27d27510b5710b.exe
  C:\Users\Admin\AppData\Local\Temp\51203fd7407ac61b8b27d27510b5710b.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:2240

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\51203fd7407ac61b8b27d27510b5710b.exe

Filesize
1.1MB

MD5
6a33b0d3a16c77171dfb5cee8d197525

SHA1
5b170c3225af0563e3f6a09cfeb383e1c3c681ea

SHA256
e9ad734069add24444cd21429d89156beb9c8281849e3e3d04cbee0925fc9bd9

SHA512
b5ccfa4b54d20876e2a1e7e00e07809d173ce1dd642a6cab32d4dcdc2189b922581ed2f439315a18f4c701d976dd3a16273ba84d15a9dd519ae9f792ebee50b4

Download Submit
\Users\Admin\AppData\Local\Temp\51203fd7407ac61b8b27d27510b5710b.exe

Filesize
938KB

MD5
a36cb9e4deff27a2cba3f6f85028a551

SHA1
0b97a89ffcdce847a6f5e20d7f7f2562fd16f27f

SHA256
cfb385e791bcb1f0634591aa4ac1e4fe70b92ea72e8ffce1f5f49a4f8f9771fa

SHA512
8f19265229289f27ad5a3e88b604a84f7bed6d37941b5991b27519a6363687b278fd07f6a211fd00f794dfef88cc6af1bf8ef08861d3857bfa62f704de53b788

Download Submit
memory/2240-16-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/2240-18-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/2240-20-0x0000000000280000-0x00000000003B3000-memory.dmp

Filesize
1.2MB

Download
memory/2240-24-0x0000000003510000-0x000000000373A000-memory.dmp

Filesize
2.2MB

Download
memory/2240-23-0x0000000000400000-0x000000000061D000-memory.dmp

Filesize
2.1MB

Download
memory/2240-32-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/2536-2-0x0000000000280000-0x00000000003B3000-memory.dmp

Filesize
1.2MB

Download
memory/2536-0-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/2536-15-0x00000000038F0000-0x0000000003DDF000-memory.dmp

Filesize
4.9MB

Download
memory/2536-14-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/2536-1-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/2536-31-0x00000000038F0000-0x0000000003DDF000-memory.dmp

Filesize
4.9MB

Download