08680de7440544a81cfb5362538eaa84e1fa3178f445fdbc5bac88e39498cdb5

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
28/01/2024, 17:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7d9edadcfbf449e8bcbb84e835b39150.exe
Size

5.3MB
MD5

7d9edadcfbf449e8bcbb84e835b39150
SHA1

011b72324128b583d871d922034d665d00119e60
SHA256

08680de7440544a81cfb5362538eaa84e1fa3178f445fdbc5bac88e39498cdb5
SHA512

ed87158d51ceec6e498aa8765e5e2db160008493d8daf3a46b2dc914f59107a0d64eff872159675aba60a2dfafb17f27c52c670091a59e4874baabfc83eaf0de
SSDEEP

98304:nq3F1c/a/hwrkrwHIWWW7qESHc4HzB1l1FshTW8HIWWW7qESHc4Hj:nKjsrkrwoWWW7e841whxoWWW7e84D

Score

7^/10

upx

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2940	7d9edadcfbf449e8bcbb84e835b39150.exe

Executes dropped EXE 1 IoCs

pid	Process
2940	7d9edadcfbf449e8bcbb84e835b39150.exe

Loads dropped DLL 1 IoCs

pid	Process
2352	7d9edadcfbf449e8bcbb84e835b39150.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2352-0-0x0000000000400000-0x00000000008E7000-memory.dmp	upx
behavioral1/files/0x000c0000000122f3-10.dat	upx
behavioral1/memory/2352-15-0x0000000003D80000-0x0000000004267000-memory.dmp	upx
behavioral1/files/0x000c0000000122f3-14.dat	upx

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2352	7d9edadcfbf449e8bcbb84e835b39150.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2352	7d9edadcfbf449e8bcbb84e835b39150.exe
2940	7d9edadcfbf449e8bcbb84e835b39150.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2352 wrote to memory of 2940	2352	7d9edadcfbf449e8bcbb84e835b39150.exe	28
PID 2352 wrote to memory of 2940	2352	7d9edadcfbf449e8bcbb84e835b39150.exe	28
PID 2352 wrote to memory of 2940	2352	7d9edadcfbf449e8bcbb84e835b39150.exe	28
PID 2352 wrote to memory of 2940	2352	7d9edadcfbf449e8bcbb84e835b39150.exe	28

C:\Users\Admin\AppData\Local\Temp\7d9edadcfbf449e8bcbb84e835b39150.exe
"C:\Users\Admin\AppData\Local\Temp\7d9edadcfbf449e8bcbb84e835b39150.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2352
- C:\Users\Admin\AppData\Local\Temp\7d9edadcfbf449e8bcbb84e835b39150.exe
  C:\Users\Admin\AppData\Local\Temp\7d9edadcfbf449e8bcbb84e835b39150.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:2940

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7d9edadcfbf449e8bcbb84e835b39150.exe

Filesize
2.0MB

MD5
ce5e6a34406eae6657b2a5ac5af99580

SHA1
1f436bf48d585cd1d053dfff46f883e95fc40369

SHA256
f0691e2d32f512843d9c913dc986df19376595b4d61d203fc0b8747857a7a079

SHA512
c0ab1ba271131b98701b2a7f8a854cdd5ac7b352e170e6c340b3d961282da03f68579b49cff8916955c326de0b3b45d554ed962baa957a9e2c59a3bf6188d1c7

Download Submit
\Users\Admin\AppData\Local\Temp\7d9edadcfbf449e8bcbb84e835b39150.exe

Filesize
1.9MB

MD5
251b36def6d4b7d1936023a5ab67fa50

SHA1
f7f1ed7fb50650fd91442ab14f222fea2e23a5c1

SHA256
858f18b0da94ef154aac38838e22e6a483786f0f6ccb9aa49d51275691c0b041

SHA512
5d6cf2c35a493cbda96986683b22a4719bdf6dcdebb1f81a238cc501a4a0d12c1df82ada3a8c3ab9f9328f4b44a7656531c133ca8096c7e4063e75b02fdd8cec

Download Submit
memory/2352-2-0x0000000000400000-0x0000000000622000-memory.dmp

Filesize
2.1MB

Download
memory/2352-0-0x0000000000400000-0x00000000008E7000-memory.dmp

Filesize
4.9MB

Download
memory/2352-16-0x0000000000400000-0x0000000000622000-memory.dmp

Filesize
2.1MB

Download
memory/2352-15-0x0000000003D80000-0x0000000004267000-memory.dmp

Filesize
4.9MB

Download
memory/2352-1-0x0000000000260000-0x0000000000391000-memory.dmp

Filesize
1.2MB

Download
memory/2940-17-0x0000000000400000-0x0000000000622000-memory.dmp

Filesize
2.1MB

Download
memory/2940-18-0x0000000001B10000-0x0000000001C41000-memory.dmp

Filesize
1.2MB

Download
memory/2940-20-0x0000000000400000-0x00000000008E7000-memory.dmp

Filesize
4.9MB

Download
memory/2940-24-0x0000000000400000-0x0000000000616000-memory.dmp

Filesize
2.1MB

Download
memory/2940-26-0x00000000033F0000-0x0000000003612000-memory.dmp

Filesize
2.1MB

Download
memory/2940-32-0x0000000000400000-0x00000000008E7000-memory.dmp

Filesize
4.9MB

Download