d95df2c3d089db6ada002ca5473aa4b2ea5fc44f8f4fc6e213d1e8a015b2fad0

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
28/01/2024, 06:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7c6a701477ef1d04f5a0400f7ef2e8e7.exe
Size

11.7MB
MD5

7c6a701477ef1d04f5a0400f7ef2e8e7
SHA1

236ce122312256a0abb580b6e52f27e031ddcc4b
SHA256

d95df2c3d089db6ada002ca5473aa4b2ea5fc44f8f4fc6e213d1e8a015b2fad0
SHA512

3dcdd359658a58e909811e97faa3e7ece2e232e9e3bbc91d5bcdb9664b8b07a7a0604c7f97a6575f469a7e2cfd1da843a095423a410b38c6636b049e5708343d
SSDEEP

196608:YIiVVgl/iBiPftLIagl/iBiPX/+vr/slGAvgl/iBiPftLIagl/iBiP:YZn2iw5Ia2ii/AslGAv2iw5Ia2i

Score

7^/10

upx

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1392	7c6a701477ef1d04f5a0400f7ef2e8e7.exe

Executes dropped EXE 1 IoCs

pid	Process
1392	7c6a701477ef1d04f5a0400f7ef2e8e7.exe

Loads dropped DLL 1 IoCs

pid	Process
2032	7c6a701477ef1d04f5a0400f7ef2e8e7.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2032-0-0x0000000000400000-0x00000000008EF000-memory.dmp	upx
behavioral1/files/0x000a00000001393e-10.dat	upx
behavioral1/memory/2032-14-0x0000000004850000-0x0000000004D3F000-memory.dmp	upx
behavioral1/files/0x000a00000001393e-15.dat	upx
behavioral1/memory/1392-17-0x0000000000400000-0x00000000008EF000-memory.dmp	upx

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2032	7c6a701477ef1d04f5a0400f7ef2e8e7.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2032	7c6a701477ef1d04f5a0400f7ef2e8e7.exe
1392	7c6a701477ef1d04f5a0400f7ef2e8e7.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2032 wrote to memory of 1392	2032	7c6a701477ef1d04f5a0400f7ef2e8e7.exe	28
PID 2032 wrote to memory of 1392	2032	7c6a701477ef1d04f5a0400f7ef2e8e7.exe	28
PID 2032 wrote to memory of 1392	2032	7c6a701477ef1d04f5a0400f7ef2e8e7.exe	28
PID 2032 wrote to memory of 1392	2032	7c6a701477ef1d04f5a0400f7ef2e8e7.exe	28

C:\Users\Admin\AppData\Local\Temp\7c6a701477ef1d04f5a0400f7ef2e8e7.exe
"C:\Users\Admin\AppData\Local\Temp\7c6a701477ef1d04f5a0400f7ef2e8e7.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2032
- C:\Users\Admin\AppData\Local\Temp\7c6a701477ef1d04f5a0400f7ef2e8e7.exe
  C:\Users\Admin\AppData\Local\Temp\7c6a701477ef1d04f5a0400f7ef2e8e7.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:1392

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7c6a701477ef1d04f5a0400f7ef2e8e7.exe

Filesize
1.2MB

MD5
114749f9554c794fb28e6f9d54be9095

SHA1
89373db6f262982e887df6c1eb80e0f0be2ff60a

SHA256
e639abb186e888b2a2e3eceb16a11a86c4aa6dc8f4e2bd25c80e698f5dbc9bbc

SHA512
fb3324e0e049d27ba76b1ef4e72f3292d83aeb93006b10b52900016e852c91eec7db705260db0f540b0b3a3bdc92b0f10f6ddf2bd20e7882ebb5d1622aa2cade

Download Submit
\Users\Admin\AppData\Local\Temp\7c6a701477ef1d04f5a0400f7ef2e8e7.exe

Filesize
192KB

MD5
82c88c15201494564801a25345ec909a

SHA1
d992cb04236ff477d846a2419f2ccccdd4d4644b

SHA256
c909dc49bc33789ff00063dd939aa5603c39c2d40e4ed6fde88b055a2ed635f3

SHA512
147e6f29d34981280a4e3d10171bc02074070448f9b5f2d6a014f355a467423c142ad5caad5341f7c0b03effa76501f59962171e5aea5841cf496731a70fdf16

Download Submit
memory/1392-17-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/1392-19-0x0000000000130000-0x0000000000263000-memory.dmp

Filesize
1.2MB

Download
memory/1392-16-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/1392-23-0x0000000000400000-0x000000000061D000-memory.dmp

Filesize
2.1MB

Download
memory/1392-25-0x0000000003590000-0x00000000037BA000-memory.dmp

Filesize
2.2MB

Download
memory/1392-31-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/2032-1-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/2032-14-0x0000000004850000-0x0000000004D3F000-memory.dmp

Filesize
4.9MB

Download
memory/2032-2-0x00000000002B0000-0x00000000003E3000-memory.dmp

Filesize
1.2MB

Download
memory/2032-0-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/2032-13-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download