8a84f79b9afe895f0d7bbcdd5ac15416824d1cc188f7005109ee7f462ffd1052

Analysis

max time kernel
119s
max time network
134s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
13/01/2024, 02:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

54acc5065c35f566bb2e493617d7bdd0.exe
Size

1.3MB
MD5

54acc5065c35f566bb2e493617d7bdd0
SHA1

b8f603b04a6b5f90240e3e341a88a55d83ee3e05
SHA256

8a84f79b9afe895f0d7bbcdd5ac15416824d1cc188f7005109ee7f462ffd1052
SHA512

213c98a2792cfb53200c5af98884ce36a57ff10decdcf99b2a291f65b67e403195fb44b0c0d458c949af7cfd75c4e72174ed7f2e1a14bd672868db3900d0c9bb
SSDEEP

24576:akiiBxZxv/TdgugyfYakxJ8hQjX0QeTnlg+J0HOCXU9/9Us:SiBTxhgjAYakD/X0QeqK0GR9j

Score

7^/10

upx

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1960	54acc5065c35f566bb2e493617d7bdd0.exe

Executes dropped EXE 1 IoCs

pid	Process
1960	54acc5065c35f566bb2e493617d7bdd0.exe

Loads dropped DLL 1 IoCs

pid	Process
2172	54acc5065c35f566bb2e493617d7bdd0.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2172-0-0x0000000000400000-0x00000000008E7000-memory.dmp	upx
behavioral1/files/0x000800000001223a-10.dat	upx
behavioral1/files/0x000800000001223a-12.dat	upx
behavioral1/files/0x000800000001223a-15.dat	upx
behavioral1/memory/2172-14-0x00000000035A0000-0x0000000003A87000-memory.dmp	upx

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2172	54acc5065c35f566bb2e493617d7bdd0.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2172	54acc5065c35f566bb2e493617d7bdd0.exe
1960	54acc5065c35f566bb2e493617d7bdd0.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2172 wrote to memory of 1960	2172	54acc5065c35f566bb2e493617d7bdd0.exe	28
PID 2172 wrote to memory of 1960	2172	54acc5065c35f566bb2e493617d7bdd0.exe	28
PID 2172 wrote to memory of 1960	2172	54acc5065c35f566bb2e493617d7bdd0.exe	28
PID 2172 wrote to memory of 1960	2172	54acc5065c35f566bb2e493617d7bdd0.exe	28

C:\Users\Admin\AppData\Local\Temp\54acc5065c35f566bb2e493617d7bdd0.exe
"C:\Users\Admin\AppData\Local\Temp\54acc5065c35f566bb2e493617d7bdd0.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2172
- C:\Users\Admin\AppData\Local\Temp\54acc5065c35f566bb2e493617d7bdd0.exe
  C:\Users\Admin\AppData\Local\Temp\54acc5065c35f566bb2e493617d7bdd0.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:1960

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\54acc5065c35f566bb2e493617d7bdd0.exe

Filesize
208KB

MD5
ffc9cb7e1d9c05f39c76b5a46ba2199c

SHA1
b6386b73ce312579072c2409aa400b588a85a5d0

SHA256
267ec91460d622cf55d3f529aea8ae4e30f5f63439815ca7fdfcc55901d94698

SHA512
16c26b2eda46bd09f538cee6a919edf6b2d883f25400bbaeb31cbb3bef50e1e32d5a9b393fd037f18be430e2f141a29d2d73e68a6e082d2925b64c00312401b8

Download Submit
C:\Users\Admin\AppData\Local\Temp\54acc5065c35f566bb2e493617d7bdd0.exe

Filesize
137KB

MD5
2e6f07b12f45ca5cb7fc62e39237cdf0

SHA1
14098486894caffc7819980c0390960413ad880a

SHA256
11da7166022b9c0578ff679cc6f1be3276ad614b0b26c64860c68e591a39ad9a

SHA512
9f0e2c90a00e86822dde703a3c9e54d83fa8cacaa4ad1d38236a8fe16401d99218114d8c8f2336e47082b084ffb606f924f42735dea45b588380f66fe99d9b70

Download Submit
\Users\Admin\AppData\Local\Temp\54acc5065c35f566bb2e493617d7bdd0.exe

Filesize
189KB

MD5
afb6613e477df2f653b4e6094fead578

SHA1
3ea3ce5f71ef48c237db69c17e24bbde4c5cc182

SHA256
bdec59f129a09aa2722988429f4bbf4556b1f5e6404c9b1fa6ae82ad0c3bcfa0

SHA512
deb8a2b46edaab9ea3b261f280b870b022120c8d110e748628191e3cabead30429b676e24d8d78aee2a8a438f2a7be8fa9cb401978760ba0dae97f2c4a006862

Download Submit
memory/1960-17-0x0000000000400000-0x00000000008E7000-memory.dmp

Filesize
4.9MB

Download
memory/1960-19-0x00000000018F0000-0x0000000001A21000-memory.dmp

Filesize
1.2MB

Download
memory/1960-16-0x0000000000400000-0x0000000000622000-memory.dmp

Filesize
2.1MB

Download
memory/1960-25-0x00000000036E0000-0x0000000003902000-memory.dmp

Filesize
2.1MB

Download
memory/1960-23-0x0000000000400000-0x0000000000616000-memory.dmp

Filesize
2.1MB

Download
memory/1960-31-0x0000000000400000-0x00000000008E7000-memory.dmp

Filesize
4.9MB

Download
memory/2172-1-0x0000000000260000-0x0000000000391000-memory.dmp

Filesize
1.2MB

Download
memory/2172-2-0x0000000000400000-0x0000000000622000-memory.dmp

Filesize
2.1MB

Download
memory/2172-0-0x0000000000400000-0x00000000008E7000-memory.dmp

Filesize
4.9MB

Download
memory/2172-14-0x00000000035A0000-0x0000000003A87000-memory.dmp

Filesize
4.9MB

Download
memory/2172-13-0x0000000000400000-0x0000000000622000-memory.dmp

Filesize
2.1MB

Download