e45e6e53c4cffdf15d202074d0f8f9580aabe998856fdefc27631962908faf23

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
27/01/2024, 23:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7b9c9cf03e3512c011633325ccd89076.exe
Size

5.8MB
MD5

7b9c9cf03e3512c011633325ccd89076
SHA1

001c5f763b2ffc65c1c8abb427093078bc3dcdbc
SHA256

e45e6e53c4cffdf15d202074d0f8f9580aabe998856fdefc27631962908faf23
SHA512

622a2461bc84d25d766a41055f0f2ca1307bb39ce3c333af9b9f4d63114343efe0d2ca070f0a338e75d097e621798983b400545f40681d5bde4f2af7418def4b
SSDEEP

98304:3GseY4HBUCczzM3RH8Ae75uIXTv64HBUCczzM3:3GseHWCdOuIDvZWC

Score

7^/10

upx

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2796	7b9c9cf03e3512c011633325ccd89076.exe

Executes dropped EXE 1 IoCs

pid	Process
2796	7b9c9cf03e3512c011633325ccd89076.exe

Loads dropped DLL 1 IoCs

pid	Process
2232	7b9c9cf03e3512c011633325ccd89076.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2232-0-0x0000000000400000-0x00000000008EF000-memory.dmp	upx
behavioral1/files/0x000d000000012251-10.dat	upx
behavioral1/memory/2232-14-0x0000000003F60000-0x000000000444F000-memory.dmp	upx
behavioral1/memory/2796-17-0x0000000000400000-0x00000000008EF000-memory.dmp	upx

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2232	7b9c9cf03e3512c011633325ccd89076.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2232	7b9c9cf03e3512c011633325ccd89076.exe
2796	7b9c9cf03e3512c011633325ccd89076.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2232 wrote to memory of 2796	2232	7b9c9cf03e3512c011633325ccd89076.exe	28
PID 2232 wrote to memory of 2796	2232	7b9c9cf03e3512c011633325ccd89076.exe	28
PID 2232 wrote to memory of 2796	2232	7b9c9cf03e3512c011633325ccd89076.exe	28
PID 2232 wrote to memory of 2796	2232	7b9c9cf03e3512c011633325ccd89076.exe	28

C:\Users\Admin\AppData\Local\Temp\7b9c9cf03e3512c011633325ccd89076.exe
"C:\Users\Admin\AppData\Local\Temp\7b9c9cf03e3512c011633325ccd89076.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2232
- C:\Users\Admin\AppData\Local\Temp\7b9c9cf03e3512c011633325ccd89076.exe
  C:\Users\Admin\AppData\Local\Temp\7b9c9cf03e3512c011633325ccd89076.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:2796

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\7b9c9cf03e3512c011633325ccd89076.exe

Filesize
5.8MB

MD5
69f5feb43a5e1abe4aaeb2ad579263b1

SHA1
8872984758cfe58233a735938a958efa340e428e

SHA256
5b77115458cecc69ee8fae9a330e4f2c5a6c0ebb8329a7b6ff8ae93016d6a34b

SHA512
785bb3c14c3e1c2a5b07ef582d16f48d98eafd7e219144b5a017ce4b6739ddad677ac13b025dbbd1591fe3d97c74448a27e2d9e4ec9e710aa1223cbdcdb23d54

Download Submit
memory/2232-13-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/2232-2-0x0000000000130000-0x0000000000263000-memory.dmp

Filesize
1.2MB

Download
memory/2232-1-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/2232-14-0x0000000003F60000-0x000000000444F000-memory.dmp

Filesize
4.9MB

Download
memory/2232-31-0x0000000003F60000-0x000000000444F000-memory.dmp

Filesize
4.9MB

Download
memory/2232-0-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/2796-16-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/2796-19-0x0000000001B20000-0x0000000001C53000-memory.dmp

Filesize
1.2MB

Download
memory/2796-23-0x0000000000400000-0x000000000061D000-memory.dmp

Filesize
2.1MB

Download
memory/2796-24-0x00000000035A0000-0x00000000037CA000-memory.dmp

Filesize
2.2MB

Download
memory/2796-17-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/2796-32-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download