713eea9771cd0fefc51af190aef8d3510528fa1a8210518fa8796d6baf816290

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24/01/2024, 10:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7204895fa37d3bdf5251057d3bfc22c5.exe
Size

1.8MB
MD5

7204895fa37d3bdf5251057d3bfc22c5
SHA1

d6833ee61cfa588363b4bffcf0c0e46111ce849f
SHA256

713eea9771cd0fefc51af190aef8d3510528fa1a8210518fa8796d6baf816290
SHA512

90c5d3ef2676d0ec2c38bfa4c9f5ba3e167ccb4265676f7ce9610f97ab9933eed26118abbb5e3cf44e83378ad8de2b30d60e4bb4b3c4a52fd280b4a7b44b63bb
SSDEEP

49152:Gkr8oywQMFw6XUXF8tEomL9M6TIakVbhOwP:tywQc1UXXp9M6TIrthOm

Score

7^/10

upx

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1132	7204895fa37d3bdf5251057d3bfc22c5.exe

Executes dropped EXE 1 IoCs

pid	Process
1132	7204895fa37d3bdf5251057d3bfc22c5.exe

Loads dropped DLL 1 IoCs

pid	Process
2436	7204895fa37d3bdf5251057d3bfc22c5.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2436-0-0x0000000000400000-0x00000000008EF000-memory.dmp	upx
behavioral1/files/0x000b000000014227-13.dat	upx
behavioral1/files/0x000b000000014227-12.dat	upx
behavioral1/memory/2436-16-0x0000000003700000-0x0000000003BEF000-memory.dmp	upx
behavioral1/files/0x000b000000014227-10.dat	upx

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2436	7204895fa37d3bdf5251057d3bfc22c5.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2436	7204895fa37d3bdf5251057d3bfc22c5.exe
1132	7204895fa37d3bdf5251057d3bfc22c5.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2436 wrote to memory of 1132	2436	7204895fa37d3bdf5251057d3bfc22c5.exe	28
PID 2436 wrote to memory of 1132	2436	7204895fa37d3bdf5251057d3bfc22c5.exe	28
PID 2436 wrote to memory of 1132	2436	7204895fa37d3bdf5251057d3bfc22c5.exe	28
PID 2436 wrote to memory of 1132	2436	7204895fa37d3bdf5251057d3bfc22c5.exe	28

C:\Users\Admin\AppData\Local\Temp\7204895fa37d3bdf5251057d3bfc22c5.exe
"C:\Users\Admin\AppData\Local\Temp\7204895fa37d3bdf5251057d3bfc22c5.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2436
- C:\Users\Admin\AppData\Local\Temp\7204895fa37d3bdf5251057d3bfc22c5.exe
  C:\Users\Admin\AppData\Local\Temp\7204895fa37d3bdf5251057d3bfc22c5.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:1132

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7204895fa37d3bdf5251057d3bfc22c5.exe

Filesize
112KB

MD5
98289739533bd6781c8c8ba74aeb9f1d

SHA1
bd21f1a52de43c89e21bc68668fb1194376165bc

SHA256
af4f5d07b4bf04cf6fda43ff6f525f4288c6aa88b651a6c588e457cd571f6792

SHA512
571c1b4f92bd275dfef5aae04fe9707133fa99495b7d6af4d7134102f349a101a171e407b2e75940e5c1a6b2d49e57e0ca8e763b56863028d7d73e90a1e88e43

Download Submit
C:\Users\Admin\AppData\Local\Temp\7204895fa37d3bdf5251057d3bfc22c5.exe

Filesize
95KB

MD5
59bf0b43879bde9adb79bcea648f1ac1

SHA1
fa7e3225e28d7e914aea8930d32ba69b254ff569

SHA256
4228b5b1b79cf222cf34b085ed3886c0363a2d92b9e5b6ea92f2882bdff08dfd

SHA512
ea384e504b10c22f10cdc6f138306421fa31effc4a40e49dc271dd22e01d2000f49b6f70d72bf40496ac281aed9f95ffeeb35cd111e33ee5b5bb64fc685571bb

Download Submit
\Users\Admin\AppData\Local\Temp\7204895fa37d3bdf5251057d3bfc22c5.exe

Filesize
199KB

MD5
9552db9f8c9fb32507f769be8a4fa042

SHA1
298726697eca71cf2c3cf3f3344887fbdb3ae6e0

SHA256
32e78f48a74e072dd260c238033a8a5f527e2ecae8a1125efa163c792f8e88cb

SHA512
1c69e78b21ebebc717f8a55314112fc24ef8f4614a5fa5e01c68ce0352d05f58e1e01568e950e1096178a7fb94ffe27e999e2399e8b57023cef4b8143bc6d48a

Download Submit
memory/1132-15-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/1132-18-0x00000000018F0000-0x0000000001A23000-memory.dmp

Filesize
1.2MB

Download
memory/1132-20-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/1132-24-0x0000000003560000-0x000000000378A000-memory.dmp

Filesize
2.2MB

Download
memory/1132-23-0x0000000000400000-0x000000000061D000-memory.dmp

Filesize
2.1MB

Download
memory/1132-31-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/2436-1-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/2436-16-0x0000000003700000-0x0000000003BEF000-memory.dmp

Filesize
4.9MB

Download
memory/2436-0-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/2436-14-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/2436-2-0x00000000018F0000-0x0000000001A23000-memory.dmp

Filesize
1.2MB

Download