4ae03171b7cf5d2560c2c2ea714c52c3decb2c2d3fd2e807cfebdc85ae5e9485

Analysis

max time kernel
119s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
12/02/2024, 11:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

971566c0c61ea90fa4121cb25a1bf6bf.exe
Size

2.9MB
MD5

971566c0c61ea90fa4121cb25a1bf6bf
SHA1

928d7764a31b2edc89ab0ef245b6bf79e8e7e7ef
SHA256

4ae03171b7cf5d2560c2c2ea714c52c3decb2c2d3fd2e807cfebdc85ae5e9485
SHA512

e9565b3687c0827777fb8a0697fde1598b8ec8d8e40d5dfbe26b8e230ad5031580e4bcd12fd071934d9bbf3d7623c2307eea25da01a886ffa5b06bed1114b0a7
SSDEEP

49152:6B5KToFC37/tVBK7N209Baj8BBT4SfcsUjoh48TyMPkXdwkyZ:W0kcL/typHau42c1joCjMPkNwk6

Score

7^/10

upx

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1668	971566c0c61ea90fa4121cb25a1bf6bf.exe

Executes dropped EXE 1 IoCs

pid	Process
1668	971566c0c61ea90fa4121cb25a1bf6bf.exe

Loads dropped DLL 1 IoCs

pid	Process
2504	971566c0c61ea90fa4121cb25a1bf6bf.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2504-0-0x0000000000400000-0x00000000008EF000-memory.dmp	upx
behavioral1/files/0x000b000000012261-10.dat	upx
behavioral1/files/0x000b000000012261-13.dat	upx
behavioral1/memory/2504-15-0x0000000003980000-0x0000000003E6F000-memory.dmp	upx

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2504	971566c0c61ea90fa4121cb25a1bf6bf.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2504	971566c0c61ea90fa4121cb25a1bf6bf.exe
1668	971566c0c61ea90fa4121cb25a1bf6bf.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2504 wrote to memory of 1668	2504	971566c0c61ea90fa4121cb25a1bf6bf.exe	28
PID 2504 wrote to memory of 1668	2504	971566c0c61ea90fa4121cb25a1bf6bf.exe	28
PID 2504 wrote to memory of 1668	2504	971566c0c61ea90fa4121cb25a1bf6bf.exe	28
PID 2504 wrote to memory of 1668	2504	971566c0c61ea90fa4121cb25a1bf6bf.exe	28

C:\Users\Admin\AppData\Local\Temp\971566c0c61ea90fa4121cb25a1bf6bf.exe
"C:\Users\Admin\AppData\Local\Temp\971566c0c61ea90fa4121cb25a1bf6bf.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2504
- C:\Users\Admin\AppData\Local\Temp\971566c0c61ea90fa4121cb25a1bf6bf.exe
  C:\Users\Admin\AppData\Local\Temp\971566c0c61ea90fa4121cb25a1bf6bf.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:1668

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\971566c0c61ea90fa4121cb25a1bf6bf.exe

Filesize
2.9MB

MD5
58f61ebffa7c8168577024f60fdd773e

SHA1
6da388741cca0602c5ad7390be2cf6b11df66847

SHA256
7c12b146f7a33e05aa37810da5384c7c1762be97c250418307df6f190ae5d14f

SHA512
4564315f7f4c8babe794aef9e85f512f0141d65a827b050febcab6d1c4eff75b8ec227c562bc69342f9935aff0b367ae86de0e07e1fe1e6bdc144b9eb3fff29f

Download Submit
\Users\Admin\AppData\Local\Temp\971566c0c61ea90fa4121cb25a1bf6bf.exe

Filesize
135KB

MD5
038d6cf0628d1b7f591cc139e485fc32

SHA1
f59b338250c79d6650e22112d916f45509eadc3e

SHA256
4ffda1046a03c4249fa4a562171d1133cfbfbae9724461bb2868aacc6d0a0962

SHA512
f67620aa5df9b2e7eaab1781464840e3118ac998e6b5511053193051e857cf519b2ea54b0ba39fb1cd29e533dddc63c219c3738296cd7fcdb814164210ad325a

Download Submit
memory/1668-17-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/1668-19-0x00000000002B0000-0x00000000003E3000-memory.dmp

Filesize
1.2MB

Download
memory/1668-16-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/1668-24-0x0000000003540000-0x000000000376A000-memory.dmp

Filesize
2.2MB

Download
memory/1668-23-0x0000000000400000-0x000000000061D000-memory.dmp

Filesize
2.1MB

Download
memory/1668-32-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/2504-2-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/2504-1-0x0000000001B20000-0x0000000001C53000-memory.dmp

Filesize
1.2MB

Download
memory/2504-14-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/2504-0-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/2504-15-0x0000000003980000-0x0000000003E6F000-memory.dmp

Filesize
4.9MB

Download
memory/2504-31-0x0000000003980000-0x0000000003E6F000-memory.dmp

Filesize
4.9MB

Download