358b905600fd5aac7828e57e2f3366f5718a0f6b61d78de4829609303f08bad0

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/01/2024, 21:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7870ddab25dcf8abec09d4f8423ce85f.exe
Size

1.3MB
MD5

7870ddab25dcf8abec09d4f8423ce85f
SHA1

d2c818a42abc698ff5036345c6bce818d5fe2fd2
SHA256

358b905600fd5aac7828e57e2f3366f5718a0f6b61d78de4829609303f08bad0
SHA512

3ca48cefda7ae4e5bcd5fc307600c36a17cb6ae14faea961e321221a9ba2e616bfc8e34416694283d8d369daa7b78dabe8b8a563a75c249e0c277bbb8f6ac855
SSDEEP

24576:t4wne9sWZ7tSRmjsXzMVDDKZEWXUNEYlVZlJf7oRQqOs7VvXjvG:uqe9SHXz+S6EWXf7oRQ/EVvX

Score

7^/10

upx

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2476	7870ddab25dcf8abec09d4f8423ce85f.exe

Executes dropped EXE 1 IoCs

pid	Process
2476	7870ddab25dcf8abec09d4f8423ce85f.exe

Loads dropped DLL 1 IoCs

pid	Process
2128	7870ddab25dcf8abec09d4f8423ce85f.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2128-0-0x0000000000400000-0x000000000086A000-memory.dmp	upx
behavioral1/files/0x000e00000001224c-11.dat	upx
behavioral1/files/0x000e00000001224c-14.dat	upx

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2128	7870ddab25dcf8abec09d4f8423ce85f.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2128	7870ddab25dcf8abec09d4f8423ce85f.exe
2476	7870ddab25dcf8abec09d4f8423ce85f.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2128 wrote to memory of 2476	2128	7870ddab25dcf8abec09d4f8423ce85f.exe	28
PID 2128 wrote to memory of 2476	2128	7870ddab25dcf8abec09d4f8423ce85f.exe	28
PID 2128 wrote to memory of 2476	2128	7870ddab25dcf8abec09d4f8423ce85f.exe	28
PID 2128 wrote to memory of 2476	2128	7870ddab25dcf8abec09d4f8423ce85f.exe	28

C:\Users\Admin\AppData\Local\Temp\7870ddab25dcf8abec09d4f8423ce85f.exe
"C:\Users\Admin\AppData\Local\Temp\7870ddab25dcf8abec09d4f8423ce85f.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2128
- C:\Users\Admin\AppData\Local\Temp\7870ddab25dcf8abec09d4f8423ce85f.exe
  C:\Users\Admin\AppData\Local\Temp\7870ddab25dcf8abec09d4f8423ce85f.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:2476

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7870ddab25dcf8abec09d4f8423ce85f.exe

Filesize
1.2MB

MD5
34ac42dd81484805ccc05905db7fd730

SHA1
7f31f460a8c9b1e7850f16816c6a8a2879454c41

SHA256
30fa1d1d566d23eed1caa5001c13a9bfd31601d7e392aa37b3bf208b601e71a7

SHA512
88af76a0fdd4bc51b07d1968d44ea1d6868aff22e5dd2e4fcc82944545344de9c30d5c1a186ecf88f765843b6c8e6581ea37dbaab6ec77ec2d19d9868aca46a4

Download Submit
\Users\Admin\AppData\Local\Temp\7870ddab25dcf8abec09d4f8423ce85f.exe

Filesize
842KB

MD5
03b15d48d578f7d368dfcce38fbcd216

SHA1
d6fc37f1bbb81742dd6ae0766ce871aef758afd5

SHA256
79082e93ec066d2c0ed8b3d606a9c2a42aa6fd16db89abc1dbcecb6d48baf43b

SHA512
1abb1caabc26930b9e5a5797e6b91397d97c21b50646cb7286c3124fe567adb12b604bcfb6c3182a4594a8e1217e8c83edf0b53208e31ccd5ab8dee8a6419342

Download Submit
memory/2128-0-0x0000000000400000-0x000000000086A000-memory.dmp

Filesize
4.4MB

Download
memory/2128-2-0x0000000001A60000-0x0000000001B72000-memory.dmp

Filesize
1.1MB

Download
memory/2128-1-0x0000000000400000-0x00000000005F2000-memory.dmp

Filesize
1.9MB

Download
memory/2128-15-0x0000000000400000-0x00000000005F2000-memory.dmp

Filesize
1.9MB

Download
memory/2128-16-0x0000000003410000-0x000000000387A000-memory.dmp

Filesize
4.4MB

Download
memory/2128-26-0x0000000003410000-0x000000000387A000-memory.dmp

Filesize
4.4MB

Download
memory/2476-18-0x0000000000400000-0x000000000086A000-memory.dmp

Filesize
4.4MB

Download
memory/2476-17-0x0000000000400000-0x00000000005F2000-memory.dmp

Filesize
1.9MB

Download
memory/2476-20-0x0000000000240000-0x0000000000352000-memory.dmp

Filesize
1.1MB

Download
memory/2476-27-0x0000000000400000-0x000000000086A000-memory.dmp

Filesize
4.4MB

Download