5593398cc4e792cd4403a30efbda651bc7d2185ac265e307b8959b9064476b34

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
12/01/2024, 00:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5501caddbf5e3131df193e7078996e9b.exe
Size

5.8MB
MD5

5501caddbf5e3131df193e7078996e9b
SHA1

69d9cb24271b4f39f3c45a0052545920088f8e36
SHA256

5593398cc4e792cd4403a30efbda651bc7d2185ac265e307b8959b9064476b34
SHA512

a452238ceaa7f8f4d7f5c42001424f9060abc36082244c244587295f9bc91696c032490d14b027b9dece2c813669dbedefb47839658345935f33da76e3528073
SSDEEP

98304:Co6LYQ5BlYZbXvpF2Yzc4HBUCczzM3ttrsR3BxnY3EAp4HBUCczzM3:CoALlYZbXB1zTWCxh+3XY4WC

Score

7^/10

upx

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2876	5501caddbf5e3131df193e7078996e9b.exe

Executes dropped EXE 1 IoCs

pid	Process
2876	5501caddbf5e3131df193e7078996e9b.exe

Loads dropped DLL 1 IoCs

pid	Process
2520	5501caddbf5e3131df193e7078996e9b.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2520-0-0x0000000000400000-0x00000000008EF000-memory.dmp	upx
behavioral1/files/0x00090000000122c9-10.dat	upx
behavioral1/files/0x00090000000122c9-13.dat	upx

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2520	5501caddbf5e3131df193e7078996e9b.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2520	5501caddbf5e3131df193e7078996e9b.exe
2876	5501caddbf5e3131df193e7078996e9b.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2520 wrote to memory of 2876	2520	5501caddbf5e3131df193e7078996e9b.exe	28
PID 2520 wrote to memory of 2876	2520	5501caddbf5e3131df193e7078996e9b.exe	28
PID 2520 wrote to memory of 2876	2520	5501caddbf5e3131df193e7078996e9b.exe	28
PID 2520 wrote to memory of 2876	2520	5501caddbf5e3131df193e7078996e9b.exe	28

C:\Users\Admin\AppData\Local\Temp\5501caddbf5e3131df193e7078996e9b.exe
"C:\Users\Admin\AppData\Local\Temp\5501caddbf5e3131df193e7078996e9b.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2520
- C:\Users\Admin\AppData\Local\Temp\5501caddbf5e3131df193e7078996e9b.exe
  C:\Users\Admin\AppData\Local\Temp\5501caddbf5e3131df193e7078996e9b.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:2876

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\5501caddbf5e3131df193e7078996e9b.exe

Filesize
347KB

MD5
5a0ab1487092e1db2fe251141bfbd1a9

SHA1
7e42cce65c3e3da15b97c62e07689ac0c2109b1f

SHA256
3c54ace91fb2acdab8b564c86dab594191abf7bd67ccb666edbc6726f91007bd

SHA512
6a4d27a83b1e79e60cbd90b157e8559cc7ded1dae25dd6f5e1a3ea075a8d24a4c26c47e8db9de8859f3bbf6036704b222e68d78cf9f65901adaaaa3a788f01e1

Download Submit
\Users\Admin\AppData\Local\Temp\5501caddbf5e3131df193e7078996e9b.exe

Filesize
649KB

MD5
dc6404de6226263ff4211c0d3da9c635

SHA1
aa4ccdd63956383a3641038f5665b916bc918981

SHA256
b3c1e8112c3bccda6d3c4767409f4ef2ad6fa05513b994b017bbbbaebb03fae9

SHA512
1d2d337cfc6654c5353ddbce5cb681e6b29e0f99c9a3969aa46626c11b08b8881fd6b73eea49f12c5b9d2539e68c98a2c81d343de4ccdf6f5fd570bc470b45dd

Download Submit
memory/2520-0-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/2520-2-0x0000000001B20000-0x0000000001C53000-memory.dmp

Filesize
1.2MB

Download
memory/2520-1-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/2520-14-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/2876-22-0x0000000000400000-0x000000000061D000-memory.dmp

Filesize
2.1MB

Download
memory/2876-24-0x0000000003410000-0x000000000363A000-memory.dmp

Filesize
2.2MB

Download
memory/2876-18-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/2876-16-0x0000000001B20000-0x0000000001C53000-memory.dmp

Filesize
1.2MB

Download
memory/2876-15-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/2876-30-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download