83c0544273ad5f1483c7c813bbcf8a8698544c2e7100a65e2bf9a4d744e79371

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
14/02/2024, 14:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9bf0bdb73efb4609002a8e994f583e0f.exe
Size

1.3MB
MD5

9bf0bdb73efb4609002a8e994f583e0f
SHA1

deb4d65f831440d2e94a06ebdb2a979411a2b4bb
SHA256

83c0544273ad5f1483c7c813bbcf8a8698544c2e7100a65e2bf9a4d744e79371
SHA512

eb03d7b8cd7e3fe7f545ec92f2ba90b17c78460ed656906faca14f68f2360a8d5371ed96fb34e836b8f9e79692b4b9752e2c3a0fd59e13272f61148ec1f2aa1f
SSDEEP

24576:cAiK3yxyPIF9jM+tTsYG4Q9cD6eSq/GlEzLX30iNl1OJKU9/9Us:cAjyx+Ic+yV8QEzLnLN3OJtR9j

Score

7^/10

upx

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2320	9bf0bdb73efb4609002a8e994f583e0f.exe

Executes dropped EXE 1 IoCs

pid	Process
2320	9bf0bdb73efb4609002a8e994f583e0f.exe

Loads dropped DLL 1 IoCs

pid	Process
2516	9bf0bdb73efb4609002a8e994f583e0f.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2516-0-0x0000000000400000-0x00000000008E7000-memory.dmp	upx
behavioral1/files/0x0007000000012284-10.dat	upx
behavioral1/files/0x0007000000012284-13.dat	upx
behavioral1/memory/2516-14-0x00000000034C0000-0x00000000039A7000-memory.dmp	upx
behavioral1/files/0x0007000000012284-12.dat	upx

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2516	9bf0bdb73efb4609002a8e994f583e0f.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2516	9bf0bdb73efb4609002a8e994f583e0f.exe
2320	9bf0bdb73efb4609002a8e994f583e0f.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2516 wrote to memory of 2320	2516	9bf0bdb73efb4609002a8e994f583e0f.exe	28
PID 2516 wrote to memory of 2320	2516	9bf0bdb73efb4609002a8e994f583e0f.exe	28
PID 2516 wrote to memory of 2320	2516	9bf0bdb73efb4609002a8e994f583e0f.exe	28
PID 2516 wrote to memory of 2320	2516	9bf0bdb73efb4609002a8e994f583e0f.exe	28

C:\Users\Admin\AppData\Local\Temp\9bf0bdb73efb4609002a8e994f583e0f.exe
"C:\Users\Admin\AppData\Local\Temp\9bf0bdb73efb4609002a8e994f583e0f.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2516
- C:\Users\Admin\AppData\Local\Temp\9bf0bdb73efb4609002a8e994f583e0f.exe
  C:\Users\Admin\AppData\Local\Temp\9bf0bdb73efb4609002a8e994f583e0f.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:2320

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\9bf0bdb73efb4609002a8e994f583e0f.exe

Filesize
448KB

MD5
f2e35e34acf88fa0ca01ceef99270375

SHA1
8dd9e6a0f2fec8f8c021087693789067f41e51ae

SHA256
1f52544f7fbf887645d0ec8b476d3ce27fdfd1321feb63e868b0495edd2a8838

SHA512
abdc3717621982406b40868637006fc772ed59dc808ae529bdbf3a158ae365307dacdde0d30865bc6546416375791299be67732cce052f39926b91c21c3ad590

Download Submit
C:\Users\Admin\AppData\Local\Temp\9bf0bdb73efb4609002a8e994f583e0f.exe

Filesize
1024KB

MD5
21b6d5fa516d47021dc2b000cfcb00cc

SHA1
5b6f048d277ddd84c32892b21a6d039df6606e92

SHA256
350cd4767eb80603350d9a2a0215387592e92b6e68f7b836f1e3a9c7453e41be

SHA512
ce38180614a09354b179be79dce721c38416c13df96ce0690f1480c655826e19c74a7ca6b5f7bfdd9b123acef82c44539f47518a9adb1b7c34d4c87b082081db

Download Submit
\Users\Admin\AppData\Local\Temp\9bf0bdb73efb4609002a8e994f583e0f.exe

Filesize
1.3MB

MD5
efac25a8f4e32b12fbd4210140890e72

SHA1
40b158cd7f8a780fee2ce10e9dbaaa5076645d80

SHA256
bff70b8007a2377171b15cdd2f493421b0595ed4f61dd3fcf7e8f0ed5fca8f4c

SHA512
146038cee73053a4f87a50413b758f24701631f05a6af8863d648d684dabf9715eb38f4d652b51ae3016435a90e2dd773a301edb67d7857b7954d49c1cde1d1c

Download Submit
memory/2320-16-0x0000000000400000-0x00000000008E7000-memory.dmp

Filesize
4.9MB

Download
memory/2320-18-0x0000000000130000-0x0000000000261000-memory.dmp

Filesize
1.2MB

Download
memory/2320-17-0x0000000000400000-0x0000000000622000-memory.dmp

Filesize
2.1MB

Download
memory/2320-23-0x0000000000400000-0x0000000000616000-memory.dmp

Filesize
2.1MB

Download
memory/2320-24-0x00000000033E0000-0x0000000003602000-memory.dmp

Filesize
2.1MB

Download
memory/2320-31-0x0000000000400000-0x00000000008E7000-memory.dmp

Filesize
4.9MB

Download
memory/2516-2-0x0000000000400000-0x0000000000622000-memory.dmp

Filesize
2.1MB

Download
memory/2516-14-0x00000000034C0000-0x00000000039A7000-memory.dmp

Filesize
4.9MB

Download
memory/2516-0-0x0000000000400000-0x00000000008E7000-memory.dmp

Filesize
4.9MB

Download
memory/2516-15-0x0000000000400000-0x0000000000622000-memory.dmp

Filesize
2.1MB

Download
memory/2516-1-0x0000000001B10000-0x0000000001C41000-memory.dmp

Filesize
1.2MB

Download