ee47f86f86e923435ecb7df5470c82d31f65c5fba952e41acad9082566046c2a

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
03/02/2024, 13:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8c7276c57467c7e96a249e8806e37cb7.exe
Size

1.3MB
MD5

8c7276c57467c7e96a249e8806e37cb7
SHA1

7a0a8acc1a5ca9479481c618578eb83e3acfa8ef
SHA256

ee47f86f86e923435ecb7df5470c82d31f65c5fba952e41acad9082566046c2a
SHA512

b052f00ef44615047e0a084306387703154fd8b7cc6967117a1f54938d945620ab3967972c474044b0e99cf60b7a5ae84fec136b000b0e572326b26e96286d2c
SSDEEP

24576:diE4qRpW/p2K7G3BpJmM0nuSHEXuaFGaSLJ+ldrQ3vG:dl4t3cByM5+4uaFGaScnrQ

Score

7^/10

upx

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2520	8c7276c57467c7e96a249e8806e37cb7.exe

Executes dropped EXE 1 IoCs

pid	Process
2520	8c7276c57467c7e96a249e8806e37cb7.exe

Loads dropped DLL 1 IoCs

pid	Process
2020	8c7276c57467c7e96a249e8806e37cb7.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2020-0-0x0000000000400000-0x000000000086A000-memory.dmp	upx
behavioral1/files/0x0009000000014826-14.dat	upx
behavioral1/files/0x0009000000014826-11.dat	upx

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2020	8c7276c57467c7e96a249e8806e37cb7.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2020	8c7276c57467c7e96a249e8806e37cb7.exe
2520	8c7276c57467c7e96a249e8806e37cb7.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2020 wrote to memory of 2520	2020	8c7276c57467c7e96a249e8806e37cb7.exe	28
PID 2020 wrote to memory of 2520	2020	8c7276c57467c7e96a249e8806e37cb7.exe	28
PID 2020 wrote to memory of 2520	2020	8c7276c57467c7e96a249e8806e37cb7.exe	28
PID 2020 wrote to memory of 2520	2020	8c7276c57467c7e96a249e8806e37cb7.exe	28

C:\Users\Admin\AppData\Local\Temp\8c7276c57467c7e96a249e8806e37cb7.exe
"C:\Users\Admin\AppData\Local\Temp\8c7276c57467c7e96a249e8806e37cb7.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2020
- C:\Users\Admin\AppData\Local\Temp\8c7276c57467c7e96a249e8806e37cb7.exe
  C:\Users\Admin\AppData\Local\Temp\8c7276c57467c7e96a249e8806e37cb7.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:2520

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\8c7276c57467c7e96a249e8806e37cb7.exe

Filesize
853KB

MD5
300120e11a59f883c4aafe341bce9619

SHA1
caf98f1c4b6012c0e6c2656995015b4c3464b124

SHA256
412dfc198fe283fdacf66758f459c33582f8a58afe7ed399747ae942d5acf673

SHA512
c364f7cb6cb99f0332481aaf1d7e3a3caeca3e0683725408efa5bdaa09bef56608cadb0665c7db047c404a97d732e9ad95bc4f347385dcb2e3b114820302dca7

Download Submit
\Users\Admin\AppData\Local\Temp\8c7276c57467c7e96a249e8806e37cb7.exe

Filesize
820KB

MD5
2a1cbdb831e3aaa926d0e5b308c06e3c

SHA1
ceb405d2a119431226b07dbb87f89ebee3aed9e1

SHA256
6fc99ca5d79032da0455a2eb410cc343a190ae12fe27c3406f224a908e12db10

SHA512
294d98a3bb93e3bc5d22796887d117638ee2eb5650c3c84940d20482b42f8828d356992cda2fa9b2e30d14501ed78f2aab7dec09c1a794ec2af12d74e4c93d80

Download Submit
memory/2020-0-0x0000000000400000-0x000000000086A000-memory.dmp

Filesize
4.4MB

Download
memory/2020-2-0x0000000000130000-0x0000000000242000-memory.dmp

Filesize
1.1MB

Download
memory/2020-1-0x0000000000400000-0x00000000005F2000-memory.dmp

Filesize
1.9MB

Download
memory/2020-16-0x00000000033F0000-0x000000000385A000-memory.dmp

Filesize
4.4MB

Download
memory/2020-15-0x0000000000400000-0x00000000005F2000-memory.dmp

Filesize
1.9MB

Download
memory/2020-26-0x00000000033F0000-0x000000000385A000-memory.dmp

Filesize
4.4MB

Download
memory/2520-18-0x0000000000400000-0x000000000086A000-memory.dmp

Filesize
4.4MB

Download
memory/2520-20-0x0000000000130000-0x0000000000242000-memory.dmp

Filesize
1.1MB

Download
memory/2520-17-0x0000000000400000-0x00000000005F2000-memory.dmp

Filesize
1.9MB

Download
memory/2520-27-0x0000000000400000-0x000000000086A000-memory.dmp

Filesize
4.4MB

Download