05c67b43e7f4e654cbe2ed454a71a570bfbf31f9dfc5ed054ffdf0435a54a75b

Analysis

max time kernel
117s
max time network
127s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24/01/2024, 14:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7274e5a2772dcdf37329afea7ec037db.exe
Size

1.3MB
MD5

7274e5a2772dcdf37329afea7ec037db
SHA1

c2596c79aa0697f5fe9d462e11b0f7d829bcdde6
SHA256

05c67b43e7f4e654cbe2ed454a71a570bfbf31f9dfc5ed054ffdf0435a54a75b
SHA512

63b47625c05960645871ed6de223059db19d6e8103697cd531d384191b994d85e9d06b435fff30b7e3a1e7c897029c02533a64c7523ba5ea3cc7aec50af06c82
SSDEEP

24576:F1osqlgHbYPPmaxCnQhcBsdLgp5BG9DjYv6KAqm7BMIlCmvG:/osh72TWsmA4vzAqm7BMo

Score

7^/10

upx

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2016	7274e5a2772dcdf37329afea7ec037db.exe

Executes dropped EXE 1 IoCs

pid	Process
2016	7274e5a2772dcdf37329afea7ec037db.exe

Loads dropped DLL 1 IoCs

pid	Process
2220	7274e5a2772dcdf37329afea7ec037db.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2220-0-0x0000000000400000-0x000000000086A000-memory.dmp	upx
behavioral1/files/0x000a000000012238-13.dat	upx
behavioral1/files/0x000a000000012238-14.dat	upx
behavioral1/files/0x000a000000012238-11.dat	upx

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2220	7274e5a2772dcdf37329afea7ec037db.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2220	7274e5a2772dcdf37329afea7ec037db.exe
2016	7274e5a2772dcdf37329afea7ec037db.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2220 wrote to memory of 2016	2220	7274e5a2772dcdf37329afea7ec037db.exe	28
PID 2220 wrote to memory of 2016	2220	7274e5a2772dcdf37329afea7ec037db.exe	28
PID 2220 wrote to memory of 2016	2220	7274e5a2772dcdf37329afea7ec037db.exe	28
PID 2220 wrote to memory of 2016	2220	7274e5a2772dcdf37329afea7ec037db.exe	28

C:\Users\Admin\AppData\Local\Temp\7274e5a2772dcdf37329afea7ec037db.exe
"C:\Users\Admin\AppData\Local\Temp\7274e5a2772dcdf37329afea7ec037db.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2220
- C:\Users\Admin\AppData\Local\Temp\7274e5a2772dcdf37329afea7ec037db.exe
  C:\Users\Admin\AppData\Local\Temp\7274e5a2772dcdf37329afea7ec037db.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:2016

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7274e5a2772dcdf37329afea7ec037db.exe

Filesize
640KB

MD5
0748ff6a7384bf183a3bacedeb715bbf

SHA1
1fdadb43fbdd046a53461d7247b74561bd4cac65

SHA256
2086b664c3e899c472338533e203188fa9f8c2f2d5c5007b20315462fcd07be1

SHA512
7ee605977350005508dcb4873c77f5ea198dc8978d00fe41061e0e8d06426f51ba5f5f0e81a5fb9c8c2d7fc6a0baa4dd5f72dd6f7a6b4204698e44e7dc43c6ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\7274e5a2772dcdf37329afea7ec037db.exe

Filesize
704KB

MD5
a2bf3f58bc52e63e0e7b0b786744b3d3

SHA1
0e54e715a7bfdd40f650bdca612c224de528b69f

SHA256
790a28a636456a55acf92427f773ce5435dc77deb6df6b5edd7ce8c9bcf2e643

SHA512
edce2f208a3eff625f69520c077458e6c769b7342d7059ae54dececf70c5371c48d7c400814b9c498984ef7c049e103ca34193f0190fc1580afed7285a709d38

Download Submit
\Users\Admin\AppData\Local\Temp\7274e5a2772dcdf37329afea7ec037db.exe

Filesize
832KB

MD5
1016e0b88ac411a178403f687c5cb1d7

SHA1
acb138a9d46ec7edd784326c0809ebe95d350f71

SHA256
0ac40057acec0f89080cfda6ac722ea81ab4cafac94b2e9c3dcf7fc30bc38820

SHA512
ea74da6d9bf46fbc6737ea51f10f9805d3f1b7d4839c61e83e5fd241579930c6473714a3ea111fa334039c0387f1212d5027f769623301cedf842880259e354a

Download Submit
memory/2016-18-0x00000000002B0000-0x00000000003C2000-memory.dmp

Filesize
1.1MB

Download
memory/2016-17-0x0000000000400000-0x00000000005F2000-memory.dmp

Filesize
1.9MB

Download
memory/2016-20-0x0000000000400000-0x000000000086A000-memory.dmp

Filesize
4.4MB

Download
memory/2016-27-0x0000000000400000-0x000000000086A000-memory.dmp

Filesize
4.4MB

Download
memory/2220-2-0x0000000000400000-0x00000000005F2000-memory.dmp

Filesize
1.9MB

Download
memory/2220-1-0x0000000001A60000-0x0000000001B72000-memory.dmp

Filesize
1.1MB

Download
memory/2220-15-0x0000000000400000-0x00000000005F2000-memory.dmp

Filesize
1.9MB

Download
memory/2220-16-0x00000000033F0000-0x000000000385A000-memory.dmp

Filesize
4.4MB

Download
memory/2220-0-0x0000000000400000-0x000000000086A000-memory.dmp

Filesize
4.4MB

Download
memory/2220-26-0x00000000033F0000-0x000000000385A000-memory.dmp

Filesize
4.4MB

Download