0a3fee19ce5e36d114444cc2ba797c9154149ca1f81bc4ad55f457f91a85fd38

Analysis

max time kernel
119s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25-01-2024 17:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

751c52cd42065e2c68e761ba9ea058ce.exe
Size

2.9MB
MD5

751c52cd42065e2c68e761ba9ea058ce
SHA1

dd874a8738076c94eb2c5be3bd312965f720de3e
SHA256

0a3fee19ce5e36d114444cc2ba797c9154149ca1f81bc4ad55f457f91a85fd38
SHA512

417c5349c09a8184be9f4fbe565c6e169490504185fa2b36555abb1ddfe1b4cae9f11826f2f6924104b0c6faf1e6d34f1bb60fcd76f7d97e20c5f9226e3f8d57
SSDEEP

49152:xBWb7HdTTA6XGW9yAJ9NBxDBF4ScN74NH5HUyNRcUsCVOzetdZJ:/Wb7HdJWW9yy9NfNVc4HBUCczzM3

Score

7^/10

upx

Malware Config

Signatures

Deletes itself 1 IoCs

Processes:

751c52cd42065e2c68e761ba9ea058ce.exe

pid process

2944 751c52cd42065e2c68e761ba9ea058ce.exe
Executes dropped EXE 1 IoCs

Processes:

751c52cd42065e2c68e761ba9ea058ce.exe

pid process

2944 751c52cd42065e2c68e761ba9ea058ce.exe
Loads dropped DLL 1 IoCs

Processes:

751c52cd42065e2c68e761ba9ea058ce.exe

pid process

1420 751c52cd42065e2c68e761ba9ea058ce.exe

pid	process
2944	751c52cd42065e2c68e761ba9ea058ce.exe

pid	process
2944	751c52cd42065e2c68e761ba9ea058ce.exe

pid	process
1420	751c52cd42065e2c68e761ba9ea058ce.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/1420-0-0x0000000000400000-0x00000000008EF000-memory.dmp	upx
\Users\Admin\AppData\Local\Temp\751c52cd42065e2c68e761ba9ea058ce.exe	upx
C:\Users\Admin\AppData\Local\Temp\751c52cd42065e2c68e761ba9ea058ce.exe	upx
behavioral1/memory/2944-17-0x0000000000400000-0x00000000008EF000-memory.dmp	upx

Suspicious behavior: RenamesItself 1 IoCs

Processes:

751c52cd42065e2c68e761ba9ea058ce.exe

pid process

1420 751c52cd42065e2c68e761ba9ea058ce.exe
Suspicious use of UnmapMainImage 2 IoCs

Processes:

751c52cd42065e2c68e761ba9ea058ce.exe751c52cd42065e2c68e761ba9ea058ce.exe

pid process

1420 751c52cd42065e2c68e761ba9ea058ce.exe
2944 751c52cd42065e2c68e761ba9ea058ce.exe

pid	process
1420	751c52cd42065e2c68e761ba9ea058ce.exe

pid	process
1420	751c52cd42065e2c68e761ba9ea058ce.exe
2944	751c52cd42065e2c68e761ba9ea058ce.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

751c52cd42065e2c68e761ba9ea058ce.exe

description	pid	process	target process
PID 1420 wrote to memory of 2944	1420	751c52cd42065e2c68e761ba9ea058ce.exe	751c52cd42065e2c68e761ba9ea058ce.exe
PID 1420 wrote to memory of 2944	1420	751c52cd42065e2c68e761ba9ea058ce.exe	751c52cd42065e2c68e761ba9ea058ce.exe
PID 1420 wrote to memory of 2944	1420	751c52cd42065e2c68e761ba9ea058ce.exe	751c52cd42065e2c68e761ba9ea058ce.exe
PID 1420 wrote to memory of 2944	1420	751c52cd42065e2c68e761ba9ea058ce.exe	751c52cd42065e2c68e761ba9ea058ce.exe

C:\Users\Admin\AppData\Local\Temp\751c52cd42065e2c68e761ba9ea058ce.exe
"C:\Users\Admin\AppData\Local\Temp\751c52cd42065e2c68e761ba9ea058ce.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1420

C:\Users\Admin\AppData\Local\Temp\751c52cd42065e2c68e761ba9ea058ce.exe
C:\Users\Admin\AppData\Local\Temp\751c52cd42065e2c68e761ba9ea058ce.exe
2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
PID:2944

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\751c52cd42065e2c68e761ba9ea058ce.exe

Filesize
896KB

MD5
20c1d0ac8d15cbaaf5a2148f3c266340

SHA1
030c11b1b7594e313714efd5a06ef623443645ce

SHA256
cb4cfc287557a6933ebbc49ae1fe83fc769ad2a0ff07fb5a85f33a6d13287182

SHA512
5dd8eb152a870d5c7104d036b5cefb40dfbd8756c7d712ccc6b824fa8f9b1ba5c075d8cf79168aae966359e0f0ab6ba02ab505d245353aabb78f4af1050b0de9

Download Submit
\Users\Admin\AppData\Local\Temp\751c52cd42065e2c68e761ba9ea058ce.exe

Filesize
1.9MB

MD5
3ae2122ef82be6fd449b8d47bd0880f4

SHA1
88320f9360ca9210bf2201d44daf8143291aae93

SHA256
4895c69ac08557b64c71aa2fc3bc424472738ce6f2fc55a929a665733a888697

SHA512
8e27542ea58870f2f91e54c5e8353bac2bbd842d0f31b9a3a565382606b7ce4f52e4675f29a037e3064ccbfc7fb60ed9949b59eadbf3120366fbad579075f20b

Download Submit
memory/1420-13-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/1420-1-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/1420-2-0x0000000001B20000-0x0000000001C53000-memory.dmp

Filesize
1.2MB

Download
memory/1420-15-0x00000000037F0000-0x0000000003CDF000-memory.dmp

Filesize
4.9MB

Download
memory/1420-0-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/1420-31-0x00000000037F0000-0x0000000003CDF000-memory.dmp

Filesize
4.9MB

Download
memory/2944-17-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/2944-19-0x0000000001B20000-0x0000000001C53000-memory.dmp

Filesize
1.2MB

Download
memory/2944-23-0x0000000000400000-0x000000000061D000-memory.dmp

Filesize
2.1MB

Download
memory/2944-24-0x0000000003410000-0x000000000363A000-memory.dmp

Filesize
2.2MB

Download
memory/2944-16-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/2944-32-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download