57c4888b51d6de8b448e650d03cbe60532995e15aa3f7c0799402edd2d4e4a74

Analysis

max time kernel
149s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
18/01/2024, 08:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

64f72f0f6278e9d2e2a078ea781ba82c.exe
Size

2.9MB
MD5

64f72f0f6278e9d2e2a078ea781ba82c
SHA1

e763228ac1bc2199176d5310d938fd98769b4e2f
SHA256

57c4888b51d6de8b448e650d03cbe60532995e15aa3f7c0799402edd2d4e4a74
SHA512

ff5781fa42e315b5b78a2322c42323d6ce36b604c138a9539c20f7b5de691fa10e472ede8f004e15918ec057496d70b4b61c73dad65a3c6d90e4d9133378d93d
SSDEEP

49152:Cv6mSmuO9PycHf3/WfR6H8hjxYsLNeC6DMleP4M338dB2IBlGuuDVUsdxxjeQZw2:Cv/9P1+f8HmlZNR6DMlegg3gnl/IVUsn

Score

7^/10

upx

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4900	64f72f0f6278e9d2e2a078ea781ba82c.exe

Executes dropped EXE 1 IoCs

pid	Process
4900	64f72f0f6278e9d2e2a078ea781ba82c.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2776-0-0x0000000000400000-0x00000000008EF000-memory.dmp	upx
behavioral2/files/0x0007000000023237-11.dat	upx
behavioral2/memory/4900-14-0x0000000000400000-0x00000000008EF000-memory.dmp	upx

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2776	64f72f0f6278e9d2e2a078ea781ba82c.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeManageVolumePrivilege	2212	svchost.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2776	64f72f0f6278e9d2e2a078ea781ba82c.exe
4900	64f72f0f6278e9d2e2a078ea781ba82c.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2776 wrote to memory of 4900	2776	64f72f0f6278e9d2e2a078ea781ba82c.exe	89
PID 2776 wrote to memory of 4900	2776	64f72f0f6278e9d2e2a078ea781ba82c.exe	89
PID 2776 wrote to memory of 4900	2776	64f72f0f6278e9d2e2a078ea781ba82c.exe	89

C:\Users\Admin\AppData\Local\Temp\64f72f0f6278e9d2e2a078ea781ba82c.exe
"C:\Users\Admin\AppData\Local\Temp\64f72f0f6278e9d2e2a078ea781ba82c.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2776
- C:\Users\Admin\AppData\Local\Temp\64f72f0f6278e9d2e2a078ea781ba82c.exe
  C:\Users\Admin\AppData\Local\Temp\64f72f0f6278e9d2e2a078ea781ba82c.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:4900

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
1⤵
PID:624

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2212

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\64f72f0f6278e9d2e2a078ea781ba82c.exe

Filesize
264KB

MD5
ac44ab3cd03597937c618857fca914f1

SHA1
cdf079ff5fad701021ed743f67c9cf9ac7d99730

SHA256
530653a1f70b910029667d88a1aab07f5793bd114a25d635b2e51c9bb1b9481b

SHA512
fc0ba57f96ac1aee526e244021acc5b3289e2ddcc1c69d6eae9c18de88fbb5c719e6b6e60e3d65705d8a60eb455746dc4a2c516df9d04f590300d0a668fc8683

Download Submit
memory/2212-29-0x000001B29E390000-0x000001B29E3A0000-memory.dmp

Filesize
64KB

Download
memory/2212-65-0x000001B2A6940000-0x000001B2A6941000-memory.dmp

Filesize
4KB

Download
memory/2212-64-0x000001B2A6830000-0x000001B2A6831000-memory.dmp

Filesize
4KB

Download
memory/2212-63-0x000001B2A6830000-0x000001B2A6831000-memory.dmp

Filesize
4KB

Download
memory/2212-61-0x000001B2A6800000-0x000001B2A6801000-memory.dmp

Filesize
4KB

Download
memory/2212-45-0x000001B29E490000-0x000001B29E4A0000-memory.dmp

Filesize
64KB

Download
memory/2776-12-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/2776-0-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/2776-2-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/2776-1-0x0000000001DC0000-0x0000000001EF3000-memory.dmp

Filesize
1.2MB

Download
memory/4900-14-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/4900-13-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/4900-28-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/4900-21-0x0000000005600000-0x000000000582A000-memory.dmp

Filesize
2.2MB

Download
memory/4900-20-0x0000000000400000-0x000000000061D000-memory.dmp

Filesize
2.1MB

Download
memory/4900-16-0x0000000001D00000-0x0000000001E33000-memory.dmp

Filesize
1.2MB

Download