f24ae5be791db0f71d062193991b73aa16b3823de829f0cc70ca739e0f819510

Analysis

max time kernel
117s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
24/02/2024, 11:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a1cc55b4a1ce416f2aaf93d41b8d4a09.exe
Size

2.7MB
MD5

a1cc55b4a1ce416f2aaf93d41b8d4a09
SHA1

873430ad240d36e1874f0fa8f4237e9cb958893d
SHA256

f24ae5be791db0f71d062193991b73aa16b3823de829f0cc70ca739e0f819510
SHA512

708a0d7d51504e4e762777f36fe02b8f613d42b6b40951b0bf6b1020d63f38d326765742cf5537471bf10fdbb5bccd6998f7ddf09ec6f45986b08759ff3a51ea
SSDEEP

49152:iuHjI8tOj6gDwPyLfAjDN/RUHSHvv648r9fsHAJImSLMW:TDPOjMPycVRUHSPv64i956mSLMW

Score

7^/10

upx

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2500	a1cc55b4a1ce416f2aaf93d41b8d4a09.exe

Executes dropped EXE 1 IoCs

pid	Process
2500	a1cc55b4a1ce416f2aaf93d41b8d4a09.exe

Loads dropped DLL 1 IoCs

pid	Process
1724	a1cc55b4a1ce416f2aaf93d41b8d4a09.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1724-0-0x0000000000400000-0x000000000086A000-memory.dmp	upx
behavioral1/files/0x000b000000012257-11.dat	upx
behavioral1/files/0x000b000000012257-14.dat	upx

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1724	a1cc55b4a1ce416f2aaf93d41b8d4a09.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
1724	a1cc55b4a1ce416f2aaf93d41b8d4a09.exe
2500	a1cc55b4a1ce416f2aaf93d41b8d4a09.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1724 wrote to memory of 2500	1724	a1cc55b4a1ce416f2aaf93d41b8d4a09.exe	28
PID 1724 wrote to memory of 2500	1724	a1cc55b4a1ce416f2aaf93d41b8d4a09.exe	28
PID 1724 wrote to memory of 2500	1724	a1cc55b4a1ce416f2aaf93d41b8d4a09.exe	28
PID 1724 wrote to memory of 2500	1724	a1cc55b4a1ce416f2aaf93d41b8d4a09.exe	28

C:\Users\Admin\AppData\Local\Temp\a1cc55b4a1ce416f2aaf93d41b8d4a09.exe
"C:\Users\Admin\AppData\Local\Temp\a1cc55b4a1ce416f2aaf93d41b8d4a09.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1724
- C:\Users\Admin\AppData\Local\Temp\a1cc55b4a1ce416f2aaf93d41b8d4a09.exe
  C:\Users\Admin\AppData\Local\Temp\a1cc55b4a1ce416f2aaf93d41b8d4a09.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:2500

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\a1cc55b4a1ce416f2aaf93d41b8d4a09.exe

Filesize
1.2MB

MD5
ecdd5cd2f9739648aca73a10b1875011

SHA1
abc45624bbc546fbc6ece7f2651583b9b5c6eef2

SHA256
e4a215c5e78d49f6f06019d26042c00f10698068fd344982f6a14e0254181a42

SHA512
41ce566e654d5d777f6b11b2fc4d55a07b32c359e0549885469994603685eaf6e850694002e086d4ae67265dcaca8aa3fff518aa68ee63f4fd37fd0f2aa1b24a

Download Submit
\Users\Admin\AppData\Local\Temp\a1cc55b4a1ce416f2aaf93d41b8d4a09.exe

Filesize
608KB

MD5
e473e701538a425c621b8bd5f9708996

SHA1
d2fd620e1f8ea953cedbcd46cf7b5cfc30af75fd

SHA256
6f7e256dd17f10df95f38d9618f689871d4958321d2e73e8543a23db8f7f3e0a

SHA512
028c7701908252255cd72768fd29c00d3f0c18d8ccfa085ee8c33ad7e7f0df2e1bc733bf6994033ef5f4a42df58432ced82d80bd7721482fb5e0045f86ec39c7

Download Submit
memory/1724-0-0x0000000000400000-0x000000000086A000-memory.dmp

Filesize
4.4MB

Download
memory/1724-2-0x0000000001A60000-0x0000000001B72000-memory.dmp

Filesize
1.1MB

Download
memory/1724-1-0x0000000000400000-0x00000000005F2000-memory.dmp

Filesize
1.9MB

Download
memory/1724-16-0x0000000003820000-0x0000000003C8A000-memory.dmp

Filesize
4.4MB

Download
memory/1724-15-0x0000000000400000-0x00000000005F2000-memory.dmp

Filesize
1.9MB

Download
memory/1724-26-0x0000000003820000-0x0000000003C8A000-memory.dmp

Filesize
4.4MB

Download
memory/2500-17-0x0000000000400000-0x000000000086A000-memory.dmp

Filesize
4.4MB

Download
memory/2500-18-0x0000000000400000-0x00000000005F2000-memory.dmp

Filesize
1.9MB

Download
memory/2500-19-0x00000000002B0000-0x00000000003C2000-memory.dmp

Filesize
1.1MB

Download
memory/2500-27-0x0000000000400000-0x000000000086A000-memory.dmp

Filesize
4.4MB

Download