fc17c9ce8d185d131a072cdd551146eba68a4a97a08c6b3ed5a93cc004704e43

Analysis

max time kernel
117s
max time network
122s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
04/02/2024, 04:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8e3f04a2b6fbe7a98125e454d9426cd6.exe
Size

21.2MB
MD5

8e3f04a2b6fbe7a98125e454d9426cd6
SHA1

d11fdc3b15c902891f558ba816f8bd9eb39cb377
SHA256

fc17c9ce8d185d131a072cdd551146eba68a4a97a08c6b3ed5a93cc004704e43
SHA512

f72054534434df45aab8b451250fd855d8c5580247c57bafa9c280ab9418149d928e194ed2e3d68c7891e98b2c56df45d2564b6b727439b4bd4d45f63d5161c8
SSDEEP

196608:oTerSA5+FA51A5+yu1VFN6M7ApA5+FA51A5+/10p+A5+FA51A5+yu1VFN6M7ApA1:br1iny75A+iYginy75A+iy

Score

7^/10

upx

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2192	8e3f04a2b6fbe7a98125e454d9426cd6.exe

Executes dropped EXE 1 IoCs

pid	Process
2192	8e3f04a2b6fbe7a98125e454d9426cd6.exe

Loads dropped DLL 1 IoCs

pid	Process
2196	8e3f04a2b6fbe7a98125e454d9426cd6.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2196-0-0x0000000000400000-0x00000000008E7000-memory.dmp	upx
behavioral1/files/0x0009000000014abe-13.dat	upx
behavioral1/files/0x0009000000014abe-10.dat	upx

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2196	8e3f04a2b6fbe7a98125e454d9426cd6.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2196	8e3f04a2b6fbe7a98125e454d9426cd6.exe
2192	8e3f04a2b6fbe7a98125e454d9426cd6.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2196 wrote to memory of 2192	2196	8e3f04a2b6fbe7a98125e454d9426cd6.exe	28
PID 2196 wrote to memory of 2192	2196	8e3f04a2b6fbe7a98125e454d9426cd6.exe	28
PID 2196 wrote to memory of 2192	2196	8e3f04a2b6fbe7a98125e454d9426cd6.exe	28
PID 2196 wrote to memory of 2192	2196	8e3f04a2b6fbe7a98125e454d9426cd6.exe	28

C:\Users\Admin\AppData\Local\Temp\8e3f04a2b6fbe7a98125e454d9426cd6.exe
"C:\Users\Admin\AppData\Local\Temp\8e3f04a2b6fbe7a98125e454d9426cd6.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2196
- C:\Users\Admin\AppData\Local\Temp\8e3f04a2b6fbe7a98125e454d9426cd6.exe
  C:\Users\Admin\AppData\Local\Temp\8e3f04a2b6fbe7a98125e454d9426cd6.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:2192

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\8e3f04a2b6fbe7a98125e454d9426cd6.exe

Filesize
343KB

MD5
841c55664c5fcef2f0c31a9e574157e7

SHA1
cb2aa1d6c3b04b2d24d0649f1210839193ff60ae

SHA256
9ccfde13019291658375391f1de350d4e5ace0f06e64375846707a7fcfd219ec

SHA512
d251cc305a33c42deffa3a3e4efed58748ba7391f3bd467ba65d1eb8290054f01c7f996e2cbfd0fafd6dc573a66ba7a93a41b210a79247b0fc11396032db8064

Download Submit
\Users\Admin\AppData\Local\Temp\8e3f04a2b6fbe7a98125e454d9426cd6.exe

Filesize
419KB

MD5
2a1cce374fcbfeaee18a59267fb35a04

SHA1
44b496e0fb9a8b73a333e4f528777251888154b4

SHA256
6a96f863a13eaaf830f3f21254ff1624b31266618f9dcd65ab3f4bd4eee90c36

SHA512
bc60a48de4842c12391083ced0df0a2451817282f6e53a89f2534cf35c760273fe96ea77b93239259e523a15e4e50bf91c53318bfc398d051696ce98145a6743

Download Submit
memory/2192-16-0x0000000000400000-0x0000000000622000-memory.dmp

Filesize
2.1MB

Download
memory/2192-17-0x0000000000400000-0x00000000008E7000-memory.dmp

Filesize
4.9MB

Download
memory/2192-15-0x0000000000260000-0x0000000000391000-memory.dmp

Filesize
1.2MB

Download
memory/2192-22-0x0000000000400000-0x0000000000616000-memory.dmp

Filesize
2.1MB

Download
memory/2192-23-0x00000000034D0000-0x00000000036F2000-memory.dmp

Filesize
2.1MB

Download
memory/2192-30-0x0000000000400000-0x00000000008E7000-memory.dmp

Filesize
4.9MB

Download
memory/2196-0-0x0000000000400000-0x00000000008E7000-memory.dmp

Filesize
4.9MB

Download
memory/2196-2-0x0000000000240000-0x0000000000371000-memory.dmp

Filesize
1.2MB

Download
memory/2196-1-0x0000000000400000-0x0000000000622000-memory.dmp

Filesize
2.1MB

Download
memory/2196-14-0x0000000000400000-0x0000000000622000-memory.dmp

Filesize
2.1MB

Download