Analysis

  • max time kernel
    122s
  • max time network
    127s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    14/01/2024, 11:01

General

  • Target

    5b1170fd534bb85ae72a7e36675ca94e.exe

  • Size

    5.8MB

  • MD5

    5b1170fd534bb85ae72a7e36675ca94e

  • SHA1

    faf8984114d756d40c0eabd3affd46a78e5dfe29

  • SHA256

    fb41d97640d9221ff05bc607a06914a8a0a23fff900379913ddbf47de5363b01

  • SHA512

    a42cdee98a7f0564a14077ce5daa7d550326f12558069b82b7d4de7fd20a43762d5495ebd12766d33af49a0f91f70bb294e56c7f56d84b03c66d1f4ee7571581

  • SSDEEP

    98304:g2vTn7BUb2mN64HBUCczzM30z9GZJ0sWzV8Pe4HBUCczzM3:gCfoZWCKg+jVOWC

Score
7/10
upx

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5b1170fd534bb85ae72a7e36675ca94e.exe
    "C:\Users\Admin\AppData\Local\Temp\5b1170fd534bb85ae72a7e36675ca94e.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: RenamesItself
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:2100
    • C:\Users\Admin\AppData\Local\Temp\5b1170fd534bb85ae72a7e36675ca94e.exe
      C:\Users\Admin\AppData\Local\Temp\5b1170fd534bb85ae72a7e36675ca94e.exe
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Suspicious use of UnmapMainImage
      PID:2292

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\5b1170fd534bb85ae72a7e36675ca94e.exe

    Filesize

    294KB

    MD5

    753f9d9d7c3bdd9a36c31b9c3f04355e

    SHA1

    4e8418f04e45f0bd002932a7b7cdbbdf045182f9

    SHA256

    3609e887e9784c7287cc7c0c90862ccf2a8ff1b5b882b173e109780c7fbac281

    SHA512

    54302c1935c334d6d41ebb1b858dcf88d6da3add20123fabd1a658df8c3f518e2f450b20ebb260dcdf494df5f037d414f5d5975621f94aed7fff8037c4036913

  • \Users\Admin\AppData\Local\Temp\5b1170fd534bb85ae72a7e36675ca94e.exe

    Filesize

    412KB

    MD5

    abf5167b1889bc783558f3d7d851ac5a

    SHA1

    ae5c15d9643ca669258c07c3575d246df62fbde9

    SHA256

    73c783be59b7c28df9824791136053df8082933a51dfdf90fda5431b41249a85

    SHA512

    00968bcc857147f0e09c17ef62abdcd937c96c4d5ec4972a82d6094c470a1643074e2e6d3f86da0f77a39475313ba4158bb33838c87a19dcc2f10b7f7a20ab9b

  • memory/2100-0-0x0000000000400000-0x000000000062A000-memory.dmp

    Filesize

    2.2MB

  • memory/2100-2-0x0000000000400000-0x00000000008EF000-memory.dmp

    Filesize

    4.9MB

  • memory/2100-4-0x0000000000130000-0x0000000000263000-memory.dmp

    Filesize

    1.2MB

  • memory/2100-14-0x0000000000400000-0x000000000062A000-memory.dmp

    Filesize

    2.2MB

  • memory/2292-15-0x0000000000400000-0x00000000008EF000-memory.dmp

    Filesize

    4.9MB

  • memory/2292-17-0x0000000000250000-0x0000000000383000-memory.dmp

    Filesize

    1.2MB

  • memory/2292-16-0x0000000000400000-0x000000000062A000-memory.dmp

    Filesize

    2.2MB

  • memory/2292-22-0x0000000000400000-0x000000000061D000-memory.dmp

    Filesize

    2.1MB

  • memory/2292-24-0x00000000034E0000-0x000000000370A000-memory.dmp

    Filesize

    2.2MB

  • memory/2292-30-0x0000000000400000-0x00000000008EF000-memory.dmp

    Filesize

    4.9MB