13161689117efe2d0b9cf670eda148e17f9f3b4c612094f6c7da52c8d551b316

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
03/02/2024, 14:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8c93bc78e063cf801c46d533f3a6bb22.exe
Size

5.8MB
MD5

8c93bc78e063cf801c46d533f3a6bb22
SHA1

a3c73cb29ddf3f0402cec7e726e43a49a02eea48
SHA256

13161689117efe2d0b9cf670eda148e17f9f3b4c612094f6c7da52c8d551b316
SHA512

27a01fd7e421d7d22506a162206174797eb44ee347037e60dac0a6bcaa45c9af443cab160a8b6d1db0b263813e66618068d30558beae732a77cd574b1de4831b
SSDEEP

98304:QlRJRAVMKJygg3gnl/IVUs1jePshe1r7baWgZBjw+gg3gnl/IVUs1jePs:QlRr1uWgl/iBiPYetu3Vgl/iBiP

Score

7^/10

upx

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1132	8c93bc78e063cf801c46d533f3a6bb22.exe

Executes dropped EXE 1 IoCs

pid	Process
1132	8c93bc78e063cf801c46d533f3a6bb22.exe

Loads dropped DLL 1 IoCs

pid	Process
2732	8c93bc78e063cf801c46d533f3a6bb22.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2732-0-0x0000000000400000-0x00000000008EF000-memory.dmp	upx
behavioral1/files/0x000a000000013a1a-13.dat	upx
behavioral1/files/0x000a000000013a1a-10.dat	upx

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2732	8c93bc78e063cf801c46d533f3a6bb22.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2732	8c93bc78e063cf801c46d533f3a6bb22.exe
1132	8c93bc78e063cf801c46d533f3a6bb22.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2732 wrote to memory of 1132	2732	8c93bc78e063cf801c46d533f3a6bb22.exe	28
PID 2732 wrote to memory of 1132	2732	8c93bc78e063cf801c46d533f3a6bb22.exe	28
PID 2732 wrote to memory of 1132	2732	8c93bc78e063cf801c46d533f3a6bb22.exe	28
PID 2732 wrote to memory of 1132	2732	8c93bc78e063cf801c46d533f3a6bb22.exe	28

C:\Users\Admin\AppData\Local\Temp\8c93bc78e063cf801c46d533f3a6bb22.exe
"C:\Users\Admin\AppData\Local\Temp\8c93bc78e063cf801c46d533f3a6bb22.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2732
- C:\Users\Admin\AppData\Local\Temp\8c93bc78e063cf801c46d533f3a6bb22.exe
  C:\Users\Admin\AppData\Local\Temp\8c93bc78e063cf801c46d533f3a6bb22.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:1132

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\8c93bc78e063cf801c46d533f3a6bb22.exe

Filesize
402KB

MD5
d9f390655386fc4bf7e86660205488b3

SHA1
b6d87514e82b058e8e301573bb494b88a4b802cc

SHA256
9b8517a28d6acde3de773d2ec9900b14edf90075522de28ce1aa7eb7c14dfa23

SHA512
ef8130ddcfe157a4d24ca00c7cd62a9cea89c973754701f120f35f31c85fa126bf5c0650e5ca5958d9ca62ef256282c6a49e1091a85516f09b2c3656a28441dc

Download Submit
\Users\Admin\AppData\Local\Temp\8c93bc78e063cf801c46d533f3a6bb22.exe

Filesize
540KB

MD5
d94513eaff94b0a7f5ee97e9724b5517

SHA1
61c0d5632e7bdef8fe0b2c3b6afbb5b02c9054db

SHA256
a09700ee4fc598406df97fb3c932d04885a0a353965a90655f5ad4665b7bb470

SHA512
f36602834fd088297a56ac6ca9174c20e56bc957cde05bf1e2be208fb82d91569ae01b57dab3d08ec608fbf24630bcc7fffe782a7c1d4d48d6e1054331d94ca6

Download Submit
memory/1132-15-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/1132-18-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/1132-16-0x0000000001B20000-0x0000000001C53000-memory.dmp

Filesize
1.2MB

Download
memory/1132-22-0x0000000000400000-0x000000000061D000-memory.dmp

Filesize
2.1MB

Download
memory/1132-25-0x0000000003410000-0x000000000363A000-memory.dmp

Filesize
2.2MB

Download
memory/1132-30-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/2732-1-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/2732-0-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/2732-2-0x0000000001B20000-0x0000000001C53000-memory.dmp

Filesize
1.2MB

Download
memory/2732-14-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download