92983319a078d081ce4ed74fda7b7e3a561e28fc7d85b1bf09f9480341b2769a

Analysis

max time kernel
117s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
04/02/2024, 10:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8eeb93003da4d9c8685c8d78190175b7.exe
Size

5.3MB
MD5

8eeb93003da4d9c8685c8d78190175b7
SHA1

66f8c1127a34519b1af407719b544b48ee0d91ce
SHA256

92983319a078d081ce4ed74fda7b7e3a561e28fc7d85b1bf09f9480341b2769a
SHA512

eba1bf8e8b5a001f8849b2b63411d11a5c19fed5cfd8f810678cc738b3020d3d04b5bdfa402fbc28316c0c2fae53c8c92513e29738fdea2d560e0dcf71db7e17
SSDEEP

98304:B7Uf3WyViQ1B6Fqhv7sO61564ekFzekTnI71B6Fqhv7sO61564ek:U3d0Q1B2gvkaAF9TnO1B2gvkaA

Score

7^/10

upx

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2744	8eeb93003da4d9c8685c8d78190175b7.exe

Executes dropped EXE 1 IoCs

pid	Process
2744	8eeb93003da4d9c8685c8d78190175b7.exe

Loads dropped DLL 1 IoCs

pid	Process
2788	8eeb93003da4d9c8685c8d78190175b7.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2788-0-0x0000000000400000-0x000000000086A000-memory.dmp	upx
behavioral1/files/0x000b000000012223-11.dat	upx
behavioral1/files/0x000b000000012223-14.dat	upx
behavioral1/memory/2744-17-0x0000000000400000-0x000000000086A000-memory.dmp	upx

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2788	8eeb93003da4d9c8685c8d78190175b7.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2788	8eeb93003da4d9c8685c8d78190175b7.exe
2744	8eeb93003da4d9c8685c8d78190175b7.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2788 wrote to memory of 2744	2788	8eeb93003da4d9c8685c8d78190175b7.exe	28
PID 2788 wrote to memory of 2744	2788	8eeb93003da4d9c8685c8d78190175b7.exe	28
PID 2788 wrote to memory of 2744	2788	8eeb93003da4d9c8685c8d78190175b7.exe	28
PID 2788 wrote to memory of 2744	2788	8eeb93003da4d9c8685c8d78190175b7.exe	28

C:\Users\Admin\AppData\Local\Temp\8eeb93003da4d9c8685c8d78190175b7.exe
"C:\Users\Admin\AppData\Local\Temp\8eeb93003da4d9c8685c8d78190175b7.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2788
- C:\Users\Admin\AppData\Local\Temp\8eeb93003da4d9c8685c8d78190175b7.exe
  C:\Users\Admin\AppData\Local\Temp\8eeb93003da4d9c8685c8d78190175b7.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:2744

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\8eeb93003da4d9c8685c8d78190175b7.exe

Filesize
895KB

MD5
f4e7e3445bd99f094fac78926dd12a3c

SHA1
6e82a4ebf90bdf38122de82403c6a594437351f2

SHA256
c108c9aef081d8df164d05ee95dbfe914a72b87a6475ee48b2d3ab683d7b4f41

SHA512
25852d3e685165660b672379a09dd4c5cbb1272938a518d75014049d63d682d478455278f791f7e65094154fa8c5125ed421bff43f3654071f0e3e5e454162b7

Download Submit
\Users\Admin\AppData\Local\Temp\8eeb93003da4d9c8685c8d78190175b7.exe

Filesize
1.5MB

MD5
ab5e8ec2be95b1f5f882313e38b88338

SHA1
68ad37cebd02ffa3ec5aae7bad47e0f9aafd3a6f

SHA256
b838d6d01129ef72bf78fc161854ca0f67d9997203a104535bc2e4438c3d9eb2

SHA512
02249ac6cdea37a8392cd73a59a61aaa70ce19907b98d141fb6fd01125ed518f5331119790c32cf419fc2c67fddc6676c4848df89c33148d27dcdc48c6de41b4

Download Submit
memory/2744-18-0x0000000000400000-0x00000000005F2000-memory.dmp

Filesize
1.9MB

Download
memory/2744-17-0x0000000000400000-0x000000000086A000-memory.dmp

Filesize
4.4MB

Download
memory/2744-19-0x00000000002D0000-0x00000000003E2000-memory.dmp

Filesize
1.1MB

Download
memory/2744-27-0x0000000000400000-0x000000000086A000-memory.dmp

Filesize
4.4MB

Download
memory/2788-0-0x0000000000400000-0x000000000086A000-memory.dmp

Filesize
4.4MB

Download
memory/2788-1-0x0000000000250000-0x0000000000362000-memory.dmp

Filesize
1.1MB

Download
memory/2788-2-0x0000000000400000-0x00000000005F2000-memory.dmp

Filesize
1.9MB

Download
memory/2788-15-0x0000000000400000-0x00000000005F2000-memory.dmp

Filesize
1.9MB

Download
memory/2788-16-0x0000000003CE0000-0x000000000414A000-memory.dmp

Filesize
4.4MB

Download
memory/2788-26-0x0000000003CE0000-0x000000000414A000-memory.dmp

Filesize
4.4MB

Download