ff5a3f602599b9b3dc809f3932eeadd0c9c47e64c3dca820073febddb195e6bb

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/01/2024, 10:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

747e325310d2e47faae365bdbb4b2893.exe
Size

1.5MB
MD5

747e325310d2e47faae365bdbb4b2893
SHA1

0853bedb497e81fc101112081333007976a970ef
SHA256

ff5a3f602599b9b3dc809f3932eeadd0c9c47e64c3dca820073febddb195e6bb
SHA512

659a3654cf35160711e85c92fe8ae7245f1c551ac458600b4356e116f01c2391af8d8a145cc4e3ac3ffce7ac8ddbe3c81cb1ef5201fb334c638f4aa45b1da9de
SSDEEP

24576:gQqRSuI9K0/g6E8kZIFzNotmHuuQ0z73fNrbPhLl/UiEIcAnW:4UP878+Ivo0uR0nfFbZyiEIcAn

Score

7^/10

upx

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2704	747e325310d2e47faae365bdbb4b2893.exe

Executes dropped EXE 1 IoCs

pid	Process
2704	747e325310d2e47faae365bdbb4b2893.exe

Loads dropped DLL 1 IoCs

pid	Process
2376	747e325310d2e47faae365bdbb4b2893.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2376-0-0x0000000000400000-0x00000000008EF000-memory.dmp	upx
behavioral1/files/0x000b000000012251-10.dat	upx
behavioral1/files/0x000b000000012251-15.dat	upx

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2376	747e325310d2e47faae365bdbb4b2893.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2376	747e325310d2e47faae365bdbb4b2893.exe
2704	747e325310d2e47faae365bdbb4b2893.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2376 wrote to memory of 2704	2376	747e325310d2e47faae365bdbb4b2893.exe	28
PID 2376 wrote to memory of 2704	2376	747e325310d2e47faae365bdbb4b2893.exe	28
PID 2376 wrote to memory of 2704	2376	747e325310d2e47faae365bdbb4b2893.exe	28
PID 2376 wrote to memory of 2704	2376	747e325310d2e47faae365bdbb4b2893.exe	28

C:\Users\Admin\AppData\Local\Temp\747e325310d2e47faae365bdbb4b2893.exe
"C:\Users\Admin\AppData\Local\Temp\747e325310d2e47faae365bdbb4b2893.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2376
- C:\Users\Admin\AppData\Local\Temp\747e325310d2e47faae365bdbb4b2893.exe
  C:\Users\Admin\AppData\Local\Temp\747e325310d2e47faae365bdbb4b2893.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:2704

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\747e325310d2e47faae365bdbb4b2893.exe

Filesize
675KB

MD5
7c0a006fbb4a79f6830ad236311307f8

SHA1
d82f19326c5554bbb13c980726441f338a19e369

SHA256
2b2aa9d729191fcc6f0d031520265f8ff77649355255d37c5ee06ae032ed388d

SHA512
a66619aa67e1551bae3f43587890dd769c2ad53545b63c1204ac024851855b277e635d52ef058dd605104b694a369371880e4b82b74e2d20ff66659fa2563149

Download Submit
\Users\Admin\AppData\Local\Temp\747e325310d2e47faae365bdbb4b2893.exe

Filesize
761KB

MD5
dc5f01331485e839244acdf5fd282f4c

SHA1
6343bd018bb8849d1e63815398ff4f2b5071a39b

SHA256
16d253285ac5e6c9a187769f3b107c70beab976b12a1d3645f2a6b5cc329a7f2

SHA512
979958374f2dbe5cc938fd408f9fa92a81ee2184cd9d77e83de0c45f5cbbe971f374cd6cbd00ebd0e242b312ba62690184faa72319f30ecaef2204d761bf2964

Download Submit
memory/2376-0-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/2376-1-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/2376-2-0x0000000001B20000-0x0000000001C53000-memory.dmp

Filesize
1.2MB

Download
memory/2376-14-0x00000000036A0000-0x0000000003B8F000-memory.dmp

Filesize
4.9MB

Download
memory/2376-13-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/2704-16-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/2704-18-0x0000000001B20000-0x0000000001C53000-memory.dmp

Filesize
1.2MB

Download
memory/2704-22-0x0000000000400000-0x000000000061D000-memory.dmp

Filesize
2.1MB

Download
memory/2704-25-0x0000000003410000-0x000000000363A000-memory.dmp

Filesize
2.2MB

Download
memory/2704-30-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download