d529c675cdd6a02da4d5b9dc005d4de2069854149db4e89163051ace2a03fa34

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
19/01/2024, 20:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

68898f214d7c20e8bfefa86dd8ed8067.exe
Size

1.5MB
MD5

68898f214d7c20e8bfefa86dd8ed8067
SHA1

ac9e8b3da26c583eeb3e0e071e8c78e05fdf89f7
SHA256

d529c675cdd6a02da4d5b9dc005d4de2069854149db4e89163051ace2a03fa34
SHA512

9c46863812fe8b659a4bbd631065559e75940ad3aa2633fb38eb79b491b1dc96f115bfe7a7a32663affb1995d0d9b441d17dae7bacba016cd31d7b39530aa5e6
SSDEEP

24576:5mVHoNAt1ANLAbqQODxSOU8lWRwNEe1xTBFegW:5mBIK1Rqudje1lHeg

Score

7^/10

upx

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3048	68898f214d7c20e8bfefa86dd8ed8067.exe

Executes dropped EXE 1 IoCs

pid	Process
3048	68898f214d7c20e8bfefa86dd8ed8067.exe

Loads dropped DLL 1 IoCs

pid	Process
2908	68898f214d7c20e8bfefa86dd8ed8067.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2908-0-0x0000000000400000-0x00000000008EF000-memory.dmp	upx
behavioral1/files/0x000a0000000139e6-10.dat	upx
behavioral1/files/0x000a0000000139e6-15.dat	upx
behavioral1/memory/2908-14-0x0000000003510000-0x00000000039FF000-memory.dmp	upx
behavioral1/memory/3048-16-0x0000000000400000-0x00000000008EF000-memory.dmp	upx

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2908	68898f214d7c20e8bfefa86dd8ed8067.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2908	68898f214d7c20e8bfefa86dd8ed8067.exe
3048	68898f214d7c20e8bfefa86dd8ed8067.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2908 wrote to memory of 3048	2908	68898f214d7c20e8bfefa86dd8ed8067.exe	28
PID 2908 wrote to memory of 3048	2908	68898f214d7c20e8bfefa86dd8ed8067.exe	28
PID 2908 wrote to memory of 3048	2908	68898f214d7c20e8bfefa86dd8ed8067.exe	28
PID 2908 wrote to memory of 3048	2908	68898f214d7c20e8bfefa86dd8ed8067.exe	28

C:\Users\Admin\AppData\Local\Temp\68898f214d7c20e8bfefa86dd8ed8067.exe
"C:\Users\Admin\AppData\Local\Temp\68898f214d7c20e8bfefa86dd8ed8067.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2908
- C:\Users\Admin\AppData\Local\Temp\68898f214d7c20e8bfefa86dd8ed8067.exe
  C:\Users\Admin\AppData\Local\Temp\68898f214d7c20e8bfefa86dd8ed8067.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:3048

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\68898f214d7c20e8bfefa86dd8ed8067.exe

Filesize
909KB

MD5
d039e3575c93b10bd657576445af7ce9

SHA1
f2574a46e1580e21530a327fa0f4678750228638

SHA256
1b5397117173443b08cc5bc16ac5102ecce3292d019511a9e61d30d1f969c9b2

SHA512
b21541b0847a1b30b7b1b9d9c7d6f906ce8eec2ac84b3796b992bc0c6ed21eb8f0a324680ee396c27107f9354da757a07a4b91a44d168544ead1d737559c76c5

Download Submit
\Users\Admin\AppData\Local\Temp\68898f214d7c20e8bfefa86dd8ed8067.exe

Filesize
963KB

MD5
6857f098d277d4ad7842d03ad07d8bf5

SHA1
b5b91cc1dcd4a42d2801ad77aa9505c3deb71362

SHA256
0b096b44024babb0c59fcdd48d392c8f0dc4f94cdfae85dc73e3e240b1d05f41

SHA512
9b6dbebaf5db5d77b5376694dcf61b0e60d0d7ebd4059c5db407433e694302c1fd69f385e903298bfad23d747a7e1f0649734e7af0c86c4944fa7e5f1278d80e

Download Submit
memory/2908-13-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/2908-2-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/2908-0-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/2908-14-0x0000000003510000-0x00000000039FF000-memory.dmp

Filesize
4.9MB

Download
memory/2908-1-0x0000000000130000-0x0000000000263000-memory.dmp

Filesize
1.2MB

Download
memory/2908-31-0x0000000003510000-0x00000000039FF000-memory.dmp

Filesize
4.9MB

Download
memory/3048-17-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/3048-16-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/3048-19-0x0000000001B20000-0x0000000001C53000-memory.dmp

Filesize
1.2MB

Download
memory/3048-23-0x0000000000400000-0x000000000061D000-memory.dmp

Filesize
2.1MB

Download
memory/3048-26-0x0000000003410000-0x000000000363A000-memory.dmp

Filesize
2.2MB

Download
memory/3048-32-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download