8be9ee0d08146cb867639a473ef12780f6cf2d8712312070c5c8b494630ca7ca

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
15-01-2024 03:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5c0786d64f38710a76e1ed11224119e6.exe
Size

1.3MB
MD5

5c0786d64f38710a76e1ed11224119e6
SHA1

101c4e03f8b863f20fec2fc28a8843096a06159e
SHA256

8be9ee0d08146cb867639a473ef12780f6cf2d8712312070c5c8b494630ca7ca
SHA512

3d1f661c257fbc70b7abf38e358dab8e5630ba380820ec84e5bd6a647254ee4d73b47c8a614ebb2d0d6d17e1792fd9acd8dec5d8bf47ed696287f5ba7f0f2fbe
SSDEEP

24576:BnTvD2QNT5hu/JFKlQ0sP6HPgjt1ap0sVh/A/JQbbWc:BTvTNTK7KO0O6v8tQprho/Jqbp

Score

7^/10

upx

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2928	5c0786d64f38710a76e1ed11224119e6.exe

Executes dropped EXE 1 IoCs

pid	Process
2928	5c0786d64f38710a76e1ed11224119e6.exe

Loads dropped DLL 1 IoCs

pid	Process
2936	5c0786d64f38710a76e1ed11224119e6.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2936-0-0x0000000000400000-0x00000000008EF000-memory.dmp	upx
behavioral1/files/0x0009000000015b6f-10.dat	upx
behavioral1/files/0x0009000000015b6f-13.dat	upx
behavioral1/files/0x0009000000015b6f-12.dat	upx

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2936	5c0786d64f38710a76e1ed11224119e6.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2936	5c0786d64f38710a76e1ed11224119e6.exe
2928	5c0786d64f38710a76e1ed11224119e6.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2936 wrote to memory of 2928	2936	5c0786d64f38710a76e1ed11224119e6.exe	28
PID 2936 wrote to memory of 2928	2936	5c0786d64f38710a76e1ed11224119e6.exe	28
PID 2936 wrote to memory of 2928	2936	5c0786d64f38710a76e1ed11224119e6.exe	28
PID 2936 wrote to memory of 2928	2936	5c0786d64f38710a76e1ed11224119e6.exe	28

C:\Users\Admin\AppData\Local\Temp\5c0786d64f38710a76e1ed11224119e6.exe
"C:\Users\Admin\AppData\Local\Temp\5c0786d64f38710a76e1ed11224119e6.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2936
- C:\Users\Admin\AppData\Local\Temp\5c0786d64f38710a76e1ed11224119e6.exe
  C:\Users\Admin\AppData\Local\Temp\5c0786d64f38710a76e1ed11224119e6.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:2928

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\5c0786d64f38710a76e1ed11224119e6.exe

Filesize
723KB

MD5
f88ec3b33d8ffd9acdaa8e2b95df13a4

SHA1
590ecbe8c9771dc63055ca25684544c32672860f

SHA256
5d22607bd1c7efd67c5a76df0ed2ace6a0a6075e54c149c9b98948567b14e306

SHA512
1dafb22b0deace566ffdd527bf051426649e1641d48393efdb369a960a97537fc55150354dd94c2e2b9559b93acfa50c566ef2d7ae0d23379170b2c7ea1fcc93

Download Submit
C:\Users\Admin\AppData\Local\Temp\5c0786d64f38710a76e1ed11224119e6.exe

Filesize
579KB

MD5
bceb77709150d0d43c8a774c2b71359b

SHA1
6df9e75fc5d9a899cada3b2bde90944f24a45cb3

SHA256
22f6f075f976d58c260bf6d278a8cd3d373b78f1a4ec11ddef9520e7ea3a1637

SHA512
2ab7aba848013db9c35d5d7a5e0f2128af77f47beb541d77b316c3f3aea4f173a1bdcfc833176f83fad23742202d712b690f20f885cddb8c011cf71f6e051172

Download Submit
\Users\Admin\AppData\Local\Temp\5c0786d64f38710a76e1ed11224119e6.exe

Filesize
723KB

MD5
dcd5378d1f6c036cfd185a729853e749

SHA1
54c4f917f749d44da19405ee1e4feb4e6b26f178

SHA256
07f61bdbcb9f6e86e611a269664e678f623dbe1b743a8975314c3a502ac802af

SHA512
c40636e87a85daa7fc533669cccbf903aeea66c16aafe8e18293beba733410ed75d003b842fa1458da4566b72820853c1c54fe3d504d289d4a00e6cf831aae6e

Download Submit
memory/2928-17-0x0000000000230000-0x0000000000363000-memory.dmp

Filesize
1.2MB

Download
memory/2928-16-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/2928-22-0x0000000000400000-0x000000000061D000-memory.dmp

Filesize
2.1MB

Download
memory/2928-24-0x00000000034C0000-0x00000000036EA000-memory.dmp

Filesize
2.2MB

Download
memory/2928-31-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/2936-0-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/2936-14-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/2936-15-0x00000000034D0000-0x00000000039BF000-memory.dmp

Filesize
4.9MB

Download
memory/2936-2-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/2936-1-0x0000000001B20000-0x0000000001C53000-memory.dmp

Filesize
1.2MB

Download
memory/2936-30-0x00000000034D0000-0x00000000039BF000-memory.dmp

Filesize
4.9MB

Download