6c1077a782c95c8dcb0cd83d2e9a45325e693df635000f7f8129d2c3c6fe32dd

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
13/02/2024, 16:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

999f3765cd39a7bb92de3ea9a064e100.exe
Size

1.5MB
MD5

999f3765cd39a7bb92de3ea9a064e100
SHA1

f0e77b6c9b1ed2c1fa5ba5038e14d057043739cd
SHA256

6c1077a782c95c8dcb0cd83d2e9a45325e693df635000f7f8129d2c3c6fe32dd
SHA512

1f41e9363efd66a84ce33a85d5e07a6266f56ec8ff4ffb03b6ae17b2cfbc3c08667d7553faade2df7def79480e9077092782ad884686ef344ab1e7dddeff1b03
SSDEEP

24576:wAko7AUDjtrJnFlvOZYc41WGBBoFTuu80bOSywIL6+qF+YtW:wAko7tVNFlBo6WF9j6SNH+A

Score

7^/10

upx

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3016	999f3765cd39a7bb92de3ea9a064e100.exe

Executes dropped EXE 1 IoCs

pid	Process
3016	999f3765cd39a7bb92de3ea9a064e100.exe

Loads dropped DLL 1 IoCs

pid	Process
2340	999f3765cd39a7bb92de3ea9a064e100.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2340-0-0x0000000000400000-0x00000000008EF000-memory.dmp	upx
behavioral1/files/0x000a00000001650c-10.dat	upx
behavioral1/memory/3016-16-0x0000000000400000-0x00000000008EF000-memory.dmp	upx

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2340	999f3765cd39a7bb92de3ea9a064e100.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2340	999f3765cd39a7bb92de3ea9a064e100.exe
3016	999f3765cd39a7bb92de3ea9a064e100.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2340 wrote to memory of 3016	2340	999f3765cd39a7bb92de3ea9a064e100.exe	28
PID 2340 wrote to memory of 3016	2340	999f3765cd39a7bb92de3ea9a064e100.exe	28
PID 2340 wrote to memory of 3016	2340	999f3765cd39a7bb92de3ea9a064e100.exe	28
PID 2340 wrote to memory of 3016	2340	999f3765cd39a7bb92de3ea9a064e100.exe	28

C:\Users\Admin\AppData\Local\Temp\999f3765cd39a7bb92de3ea9a064e100.exe
"C:\Users\Admin\AppData\Local\Temp\999f3765cd39a7bb92de3ea9a064e100.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2340
- C:\Users\Admin\AppData\Local\Temp\999f3765cd39a7bb92de3ea9a064e100.exe
  C:\Users\Admin\AppData\Local\Temp\999f3765cd39a7bb92de3ea9a064e100.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:3016

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\999f3765cd39a7bb92de3ea9a064e100.exe

Filesize
1.5MB

MD5
9084335a645a69b5c1174951c28c4c8d

SHA1
1568eb56c94892552eb793db7d48ad995a1bbe12

SHA256
8690f46a43602bcbc23782969c653aeef298919cc9ee1c6cc53c221bd665bf86

SHA512
17ef32553b5f9678038444d2bfc8517d5a22df872aa511855ff8bf74699ad1f37fc4eaba2e486ebcbbdf2c62d3400e9f2417530c963ace16065832a3e56f2f17

Download Submit
memory/2340-31-0x00000000034F0000-0x00000000039DF000-memory.dmp

Filesize
4.9MB

Download
memory/2340-2-0x0000000000130000-0x0000000000263000-memory.dmp

Filesize
1.2MB

Download
memory/2340-1-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/2340-15-0x00000000034F0000-0x00000000039DF000-memory.dmp

Filesize
4.9MB

Download
memory/2340-14-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/2340-0-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/3016-17-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/3016-16-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/3016-23-0x0000000000400000-0x000000000061D000-memory.dmp

Filesize
2.1MB

Download
memory/3016-24-0x00000000035C0000-0x00000000037EA000-memory.dmp

Filesize
2.2MB

Download
memory/3016-18-0x0000000000130000-0x0000000000263000-memory.dmp

Filesize
1.2MB

Download
memory/3016-32-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download