bf92f2e583ddb6de68cdab370ec56da088a3fa758cea6702bda1e0559e9f1dd9

Analysis

max time kernel
119s
max time network
127s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
12/01/2024, 18:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

572f91fc9e4202e4b4aced06a18f5036.exe
Size

2.4MB
MD5

572f91fc9e4202e4b4aced06a18f5036
SHA1

9cd52030a13431507e645317aac5de41e6870d8b
SHA256

bf92f2e583ddb6de68cdab370ec56da088a3fa758cea6702bda1e0559e9f1dd9
SHA512

b9b8d56e9216726941112b91f2cdd9bbbce06baf3f90f3b4124bb6709689d98a446b67c816f4395bf6c9fc7616010ce4b6588eb051ee03fd82f61a060c16bf47
SSDEEP

49152:0M/5Rt2OgZgE8pYcB21ecqOLs1O8WccP4M338dB2IBlGuuDVUsdxxjr:0uLgZgE8ScBkLHXgg3gnl/IVUs1jr

Score

7^/10

upx

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2076	572f91fc9e4202e4b4aced06a18f5036.exe

Executes dropped EXE 1 IoCs

pid	Process
2076	572f91fc9e4202e4b4aced06a18f5036.exe

Loads dropped DLL 1 IoCs

pid	Process
2052	572f91fc9e4202e4b4aced06a18f5036.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2052-2-0x0000000000400000-0x00000000008EF000-memory.dmp	upx
behavioral1/files/0x000a00000001226e-12.dat	upx
behavioral1/files/0x000a00000001226e-15.dat	upx
behavioral1/memory/2076-16-0x0000000000400000-0x00000000008EF000-memory.dmp	upx

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2052	572f91fc9e4202e4b4aced06a18f5036.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2052	572f91fc9e4202e4b4aced06a18f5036.exe
2076	572f91fc9e4202e4b4aced06a18f5036.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2052 wrote to memory of 2076	2052	572f91fc9e4202e4b4aced06a18f5036.exe	28
PID 2052 wrote to memory of 2076	2052	572f91fc9e4202e4b4aced06a18f5036.exe	28
PID 2052 wrote to memory of 2076	2052	572f91fc9e4202e4b4aced06a18f5036.exe	28
PID 2052 wrote to memory of 2076	2052	572f91fc9e4202e4b4aced06a18f5036.exe	28

C:\Users\Admin\AppData\Local\Temp\572f91fc9e4202e4b4aced06a18f5036.exe
"C:\Users\Admin\AppData\Local\Temp\572f91fc9e4202e4b4aced06a18f5036.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2052
- C:\Users\Admin\AppData\Local\Temp\572f91fc9e4202e4b4aced06a18f5036.exe
  C:\Users\Admin\AppData\Local\Temp\572f91fc9e4202e4b4aced06a18f5036.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:2076

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\572f91fc9e4202e4b4aced06a18f5036.exe

Filesize
704KB

MD5
4e627b2135f732145596d10e0cf4e94d

SHA1
deff25f27974215ad108b77af427a4042a4fb047

SHA256
04dc09348fef628932ad97160d787023229bf8dc3631e0fa50b3e874cf55c97b

SHA512
0a704013f12dbf8458d59de97c2b3641f9243822f307ecac98de037510e4c9a321be58ff0d5514118220d76769304ba484d0ce8925bba3af0a091c9108e44c61

Download Submit
C:\Users\Admin\AppData\Local\Temp\572f91fc9e4202e4b4aced06a18f5036.exe

Filesize
2.4MB

MD5
aa32946a039a2a9e9fe054089061ac51

SHA1
b2b1047906ef474ceb749f7c9832784566daa6da

SHA256
2446b107d73878306a107dadc745d746cc5cf1fae2d32cf3615ec040559fe9a0

SHA512
d75594b1d384143e05bfa3e8f3d66a98ed2c7905c9b35e3c8703c1b6ac01a16b6127a0b57d94654a956b5d53c8bd0f1f3a71546a5e6032b38e676c9e021b8549

Download Submit
memory/2052-13-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/2052-5-0x00000000018F0000-0x0000000001A23000-memory.dmp

Filesize
1.2MB

Download
memory/2052-2-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/2052-14-0x0000000003850000-0x0000000003D3F000-memory.dmp

Filesize
4.9MB

Download
memory/2052-0-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/2052-31-0x0000000003850000-0x0000000003D3F000-memory.dmp

Filesize
4.9MB

Download
memory/2076-16-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/2076-17-0x0000000000240000-0x0000000000373000-memory.dmp

Filesize
1.2MB

Download
memory/2076-18-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/2076-23-0x0000000000400000-0x000000000061D000-memory.dmp

Filesize
2.1MB

Download
memory/2076-24-0x00000000034D0000-0x00000000036FA000-memory.dmp

Filesize
2.2MB

Download
memory/2076-32-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download