Analysis

  • max time kernel
    117s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    01/02/2024, 10:45

General

  • Target

    86b1aeb8274105ab2ada325f23857d32.exe

  • Size

    1.3MB

  • MD5

    86b1aeb8274105ab2ada325f23857d32

  • SHA1

    15f1d9731e894055a7c833e6566d6aab11a83761

  • SHA256

    106d44053f992d84c548e2641826c458434f70b8a0810e1405f2c693bb9c6985

  • SHA512

    1623538854f9a51eca11383c518933ebec05b29d8276aa7a522ee9616cbd6d073fc3bb47e4c1f075bcfcf8933560c7dd5c1155e11641ddeeb268445042e454c8

  • SSDEEP

    24576:scf6odiivL2iXtiUZDS3uPB7NFqEmq0Zojs0tosoRGUfBlkMYNs5mzx7U9/9Us:hTvqiXUUoePhNh5tAGUkMYUm14R9j

Score
7/10
upx

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\86b1aeb8274105ab2ada325f23857d32.exe
    "C:\Users\Admin\AppData\Local\Temp\86b1aeb8274105ab2ada325f23857d32.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: RenamesItself
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:2552
    • C:\Users\Admin\AppData\Local\Temp\86b1aeb8274105ab2ada325f23857d32.exe
      C:\Users\Admin\AppData\Local\Temp\86b1aeb8274105ab2ada325f23857d32.exe
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Suspicious use of UnmapMainImage
      PID:3048

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\86b1aeb8274105ab2ada325f23857d32.exe

    Filesize

    693KB

    MD5

    c327630bce13ee02db915d2646a93753

    SHA1

    0862a87523d9eac315877e9710c47f0c0ca4b5f2

    SHA256

    c0d019ec1af2908d7fb9ff1d4cbc92aefa98b838595db464bd5f744ceb4da79f

    SHA512

    3ddeeb82ca44d781098d09246dbfc3243e4575096f6a44b1d34eeb25aa643c716c91ce9c602042dbb344a1088b83936e63d77808d416bf6d5c579fe14d37ac26

  • \Users\Admin\AppData\Local\Temp\86b1aeb8274105ab2ada325f23857d32.exe

    Filesize

    849KB

    MD5

    6f34d6b0a0a11f77ca9c8c46c6a69ff9

    SHA1

    73cc9b2a6cf84a7b2e02ae3b919dcd13aade4493

    SHA256

    d06f7904f45970c655c24fb4fe203a0c2f7096fac4a7b102885cae39e59d9bda

    SHA512

    fb3da6f7a3560c511e8a3c6e99108a4c3edae933d9d95d42672eea6abedcfdb97eae1660e27251f78678fba8bef79e6ce1e61d3e0ac470987c4b6e7714921a5c

  • memory/2552-0-0x0000000000400000-0x00000000008E7000-memory.dmp

    Filesize

    4.9MB

  • memory/2552-2-0x0000000001B10000-0x0000000001C41000-memory.dmp

    Filesize

    1.2MB

  • memory/2552-1-0x0000000000400000-0x0000000000622000-memory.dmp

    Filesize

    2.1MB

  • memory/2552-14-0x0000000000400000-0x0000000000622000-memory.dmp

    Filesize

    2.1MB

  • memory/3048-15-0x0000000000400000-0x0000000000622000-memory.dmp

    Filesize

    2.1MB

  • memory/3048-18-0x0000000000400000-0x00000000008E7000-memory.dmp

    Filesize

    4.9MB

  • memory/3048-16-0x00000000018F0000-0x0000000001A21000-memory.dmp

    Filesize

    1.2MB

  • memory/3048-23-0x0000000003550000-0x0000000003772000-memory.dmp

    Filesize

    2.1MB

  • memory/3048-22-0x0000000000400000-0x0000000000616000-memory.dmp

    Filesize

    2.1MB

  • memory/3048-30-0x0000000000400000-0x00000000008E7000-memory.dmp

    Filesize

    4.9MB