2368dd21772f32ea71fca60e16dde252a9df12854825ca84e2f5945d7820932e

Analysis

max time kernel
120s
max time network
129s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
12-02-2024 01:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

95e2332ba52b6152d886ffc639d4db42.exe
Size

2.9MB
MD5

95e2332ba52b6152d886ffc639d4db42
SHA1

d2e404168def214e75b3ae0022c536aed3282bad
SHA256

2368dd21772f32ea71fca60e16dde252a9df12854825ca84e2f5945d7820932e
SHA512

5dfd56fbbc6eea673c52e9d2bed4ec0e85e2de4bbb2fdfdd18bb9c950429aee15d6d61e57b1b9984e63c7aac3018ad67182aa2a675252de6b2ea0bb309d88c5a
SSDEEP

49152:/mTYgMsbTHI1wpOaWpobJyMLGlZiFW4VNYYYCx3GKvgJLfFVEAR3+tEJuLK7Q:/mTYHUo1wAacoVyflmNkYbvgJhVd6e7Q

Score

7^/10

upx

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2356	95e2332ba52b6152d886ffc639d4db42.exe

Executes dropped EXE 1 IoCs

pid	Process
2356	95e2332ba52b6152d886ffc639d4db42.exe

Loads dropped DLL 1 IoCs

pid	Process
1744	95e2332ba52b6152d886ffc639d4db42.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1744-1-0x0000000000400000-0x00000000008EF000-memory.dmp	upx
behavioral1/files/0x000b000000012731-10.dat	upx
behavioral1/files/0x000b000000012731-12.dat	upx
behavioral1/memory/1744-15-0x00000000038C0000-0x0000000003DAF000-memory.dmp	upx
behavioral1/memory/2356-16-0x0000000000400000-0x00000000008EF000-memory.dmp	upx

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1744	95e2332ba52b6152d886ffc639d4db42.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
1744	95e2332ba52b6152d886ffc639d4db42.exe
2356	95e2332ba52b6152d886ffc639d4db42.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1744 wrote to memory of 2356	1744	95e2332ba52b6152d886ffc639d4db42.exe	28
PID 1744 wrote to memory of 2356	1744	95e2332ba52b6152d886ffc639d4db42.exe	28
PID 1744 wrote to memory of 2356	1744	95e2332ba52b6152d886ffc639d4db42.exe	28
PID 1744 wrote to memory of 2356	1744	95e2332ba52b6152d886ffc639d4db42.exe	28

C:\Users\Admin\AppData\Local\Temp\95e2332ba52b6152d886ffc639d4db42.exe
"C:\Users\Admin\AppData\Local\Temp\95e2332ba52b6152d886ffc639d4db42.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1744
- C:\Users\Admin\AppData\Local\Temp\95e2332ba52b6152d886ffc639d4db42.exe
  C:\Users\Admin\AppData\Local\Temp\95e2332ba52b6152d886ffc639d4db42.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:2356

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\95e2332ba52b6152d886ffc639d4db42.exe

Filesize
2.9MB

MD5
809f4337bac029220f339217bd542714

SHA1
ec6fbbf255137b84f63ed10a158afa58961e9b66

SHA256
6f9f7395cbcceacc42e8770019045ec2a44b1ab838a0d032698069abb77c77b9

SHA512
8c4b47277bbeab7b176f1e7beb35bbad583c1a2b929aae343397d716305efc184637e8fe2f5590bf17de9167f26edebdd9d074560d63e2371976e2587f4e1337

Download Submit
\Users\Admin\AppData\Local\Temp\95e2332ba52b6152d886ffc639d4db42.exe

Filesize
64KB

MD5
f3e0c67d0a8cdd62bcba31999b77b731

SHA1
920f358fd00715ef1f3ffe80bb2b566e7025f93a

SHA256
432dee16ef59523c32c68171bb02b779d5494e7085fc327f443eb4fe6c4eee2f

SHA512
9ca6c839029892c7181522eb14a77cac4d90116a989cd857277e85577fd924200c033de4e61846072489c046151e786b9fe5d878932e226b125cabc03723f41a

Download Submit
memory/1744-14-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/1744-3-0x0000000000250000-0x0000000000383000-memory.dmp

Filesize
1.2MB

Download
memory/1744-1-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/1744-15-0x00000000038C0000-0x0000000003DAF000-memory.dmp

Filesize
4.9MB

Download
memory/1744-0-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/1744-31-0x00000000038C0000-0x0000000003DAF000-memory.dmp

Filesize
4.9MB

Download
memory/2356-16-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/2356-18-0x0000000001B20000-0x0000000001C53000-memory.dmp

Filesize
1.2MB

Download
memory/2356-17-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/2356-24-0x00000000035A0000-0x00000000037CA000-memory.dmp

Filesize
2.2MB

Download
memory/2356-23-0x0000000000400000-0x000000000061D000-memory.dmp

Filesize
2.1MB

Download
memory/2356-32-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download