2b0a55a3dcc3d28495c7626f071a82a4eee667120ecce6fca82303721392fe9d

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
19-01-2024 14:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

67d1522a0d43a70b54e0536bfecb0d62.exe
Size

1.3MB
MD5

67d1522a0d43a70b54e0536bfecb0d62
SHA1

56f071c2b27caddd75bd3a7d4181f2ad007ee50d
SHA256

2b0a55a3dcc3d28495c7626f071a82a4eee667120ecce6fca82303721392fe9d
SHA512

1b821126059824b7a58edeaf3e5640e20f9ce04e82deeef14bfa441a32e6a9c2ff71c86abc725ff723e65a22cc605ba2df45b60b690c9edd1011778f572314ae
SSDEEP

24576:Bnkwr/R3DyghBQk7vXvuHY5pFzsZ9LDC8ZGBbtSej77U9/9Us:l9rpWghBQszFzs7mcobzj74R9j

Score

7^/10

upx

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2660	67d1522a0d43a70b54e0536bfecb0d62.exe

Executes dropped EXE 1 IoCs

pid	Process
2660	67d1522a0d43a70b54e0536bfecb0d62.exe

Loads dropped DLL 1 IoCs

pid	Process
3020	67d1522a0d43a70b54e0536bfecb0d62.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/3020-0-0x0000000000400000-0x00000000008E7000-memory.dmp	upx
behavioral1/files/0x000b00000001224d-13.dat	upx
behavioral1/files/0x000b00000001224d-10.dat	upx

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3020	67d1522a0d43a70b54e0536bfecb0d62.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
3020	67d1522a0d43a70b54e0536bfecb0d62.exe
2660	67d1522a0d43a70b54e0536bfecb0d62.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3020 wrote to memory of 2660	3020	67d1522a0d43a70b54e0536bfecb0d62.exe	28
PID 3020 wrote to memory of 2660	3020	67d1522a0d43a70b54e0536bfecb0d62.exe	28
PID 3020 wrote to memory of 2660	3020	67d1522a0d43a70b54e0536bfecb0d62.exe	28
PID 3020 wrote to memory of 2660	3020	67d1522a0d43a70b54e0536bfecb0d62.exe	28

C:\Users\Admin\AppData\Local\Temp\67d1522a0d43a70b54e0536bfecb0d62.exe
"C:\Users\Admin\AppData\Local\Temp\67d1522a0d43a70b54e0536bfecb0d62.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3020
- C:\Users\Admin\AppData\Local\Temp\67d1522a0d43a70b54e0536bfecb0d62.exe
  C:\Users\Admin\AppData\Local\Temp\67d1522a0d43a70b54e0536bfecb0d62.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:2660

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\67d1522a0d43a70b54e0536bfecb0d62.exe

Filesize
413KB

MD5
38235b2b86bce069dbff2e34409f1803

SHA1
66ac1bd1ab526bae4bd3c4a35d49f7427cc5dc1c

SHA256
26c8ae76e6012ddd9a366a40a239b3cb54556db66b5e3560d8ded991ec4eb004

SHA512
f69549e5cd71a43deee150cf9de998cbdb0472ecc3c7666580d7617dcc09569f8bcc56b0517bf802d8182b0bf6da75a9d03968d2753659889f0b0d00359d1fd8

Download Submit
\Users\Admin\AppData\Local\Temp\67d1522a0d43a70b54e0536bfecb0d62.exe

Filesize
456KB

MD5
e8e26ee3f0bb4920cbd36f83e89c70dd

SHA1
a47436b2c005557888cf6d15ee9e6e9a196b73c1

SHA256
f46f9587333d40cedbee8569f4f67f10c74e1581fe8ac84091513787e3d4c006

SHA512
ba4164e9152cc04c44cb5be8d01189c21acacb67a15553924fc73758266acb4d3b35e8801554fddb7e82810274cfee2a4e88dbde366bc7156c2c3301fc950a87

Download Submit
memory/2660-18-0x0000000000400000-0x00000000008E7000-memory.dmp

Filesize
4.9MB

Download
memory/2660-20-0x0000000001B10000-0x0000000001C41000-memory.dmp

Filesize
1.2MB

Download
memory/2660-15-0x0000000000400000-0x0000000000622000-memory.dmp

Filesize
2.1MB

Download
memory/2660-23-0x0000000000400000-0x0000000000616000-memory.dmp

Filesize
2.1MB

Download
memory/2660-25-0x00000000033F0000-0x0000000003612000-memory.dmp

Filesize
2.1MB

Download
memory/2660-31-0x0000000000400000-0x00000000008E7000-memory.dmp

Filesize
4.9MB

Download
memory/3020-14-0x0000000000400000-0x0000000000622000-memory.dmp

Filesize
2.1MB

Download
memory/3020-1-0x0000000000400000-0x0000000000622000-memory.dmp

Filesize
2.1MB

Download
memory/3020-16-0x00000000035D0000-0x0000000003AB7000-memory.dmp

Filesize
4.9MB

Download
memory/3020-0-0x0000000000400000-0x00000000008E7000-memory.dmp

Filesize
4.9MB

Download
memory/3020-2-0x0000000000290000-0x00000000003C1000-memory.dmp

Filesize
1.2MB

Download