598e5408c0c164ed0cd213226fff513fabbf2e41920df1cb5a261b0da867dd4e

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
27-01-2024 00:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

78bfb1ba98c0a3a2c764520f9179d9a5.exe
Size

1.5MB
MD5

78bfb1ba98c0a3a2c764520f9179d9a5
SHA1

0ad3a2ce0452a0d35e800bf51c42595cd5913af0
SHA256

598e5408c0c164ed0cd213226fff513fabbf2e41920df1cb5a261b0da867dd4e
SHA512

dd9426f66ed1ae43c7553f715d6579a4797bc6c3705d998783444001650b78a3613d2fbf33b7429145b31be0e1a9c77a548c181fcc922260bdbf6458cf29d9f0
SSDEEP

24576:hyZr7dhMPeuBS0ezGNFXs6kzuPq+ZPcebgBH2UBB/5Yeu+Tbx7DWW:h4HaeD0eu5quPcmg0Uv/5/u+TbVW

Score

7^/10

upx

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2440	78bfb1ba98c0a3a2c764520f9179d9a5.exe

Executes dropped EXE 1 IoCs

pid	Process
2440	78bfb1ba98c0a3a2c764520f9179d9a5.exe

Loads dropped DLL 1 IoCs

pid	Process
2252	78bfb1ba98c0a3a2c764520f9179d9a5.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2252-0-0x0000000000400000-0x00000000008EF000-memory.dmp	upx
behavioral1/files/0x000b0000000122dc-10.dat	upx
behavioral1/files/0x000b0000000122dc-13.dat	upx

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2252	78bfb1ba98c0a3a2c764520f9179d9a5.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2252	78bfb1ba98c0a3a2c764520f9179d9a5.exe
2440	78bfb1ba98c0a3a2c764520f9179d9a5.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2252 wrote to memory of 2440	2252	78bfb1ba98c0a3a2c764520f9179d9a5.exe	28
PID 2252 wrote to memory of 2440	2252	78bfb1ba98c0a3a2c764520f9179d9a5.exe	28
PID 2252 wrote to memory of 2440	2252	78bfb1ba98c0a3a2c764520f9179d9a5.exe	28
PID 2252 wrote to memory of 2440	2252	78bfb1ba98c0a3a2c764520f9179d9a5.exe	28

C:\Users\Admin\AppData\Local\Temp\78bfb1ba98c0a3a2c764520f9179d9a5.exe
"C:\Users\Admin\AppData\Local\Temp\78bfb1ba98c0a3a2c764520f9179d9a5.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2252
- C:\Users\Admin\AppData\Local\Temp\78bfb1ba98c0a3a2c764520f9179d9a5.exe
  C:\Users\Admin\AppData\Local\Temp\78bfb1ba98c0a3a2c764520f9179d9a5.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:2440

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\78bfb1ba98c0a3a2c764520f9179d9a5.exe

Filesize
991KB

MD5
e579e0280679cac9fdb25244acbfa12f

SHA1
967d7481825527e86991ae01cf11b6b32034584a

SHA256
572ec69d64a5a6db6c2b0e5269e297d7a0ba404a6392f175b5f1bf11c07f57c9

SHA512
8de2bb680de6da173ebd0bb708f154ae9e7567712e0b584e3535c2eda1a0e994c75b90362cf28339d55daed44c01c4fc053e123a24a4a889a608b4a822ba0c31

Download Submit
\Users\Admin\AppData\Local\Temp\78bfb1ba98c0a3a2c764520f9179d9a5.exe

Filesize
941KB

MD5
af18dce74f95c5da5d9f3d4fb3d01e03

SHA1
6e8b38ddf0cf38d4cac10d0925cab042a028b27a

SHA256
2c4b2cf16f57d1b3f47e9feb324718a7c648e3694ce46f0d54f3f37979688b7a

SHA512
d77db4e6ee42e15c23f2596a957f2ea0d55e9ee24d4cc24354eb12a19dccde0d560181f22ba0e4168802dc015aaa1170146ed61bef8c75a0ccca31d7f212ac44

Download Submit
memory/2252-0-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/2252-2-0x0000000001B20000-0x0000000001C53000-memory.dmp

Filesize
1.2MB

Download
memory/2252-1-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/2252-14-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/2440-15-0x0000000000130000-0x0000000000263000-memory.dmp

Filesize
1.2MB

Download
memory/2440-16-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/2440-17-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/2440-22-0x0000000000400000-0x000000000061D000-memory.dmp

Filesize
2.1MB

Download
memory/2440-24-0x00000000035B0000-0x00000000037DA000-memory.dmp

Filesize
2.2MB

Download
memory/2440-30-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download