dedce699d9aa64f357ecaa5c59158a2cc8b957979d25b854deb7ecc280bfbcf7

Analysis

max time kernel
120s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28-02-2024 07:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ab61877aeba85f2299873654cb2f3990.exe
Size

10.6MB
MD5

ab61877aeba85f2299873654cb2f3990
SHA1

1469d4e761e332c386d352743791dd938601fb40
SHA256

dedce699d9aa64f357ecaa5c59158a2cc8b957979d25b854deb7ecc280bfbcf7
SHA512

2e949c142b44c39b905452dc4245a5ff591c6e8704f7fb50d39258b79eae5e7637a8ef9f6f2aaaa6a27302ad7c18269fbd3a04c95d662184c03e605319a57f5f
SSDEEP

196608:j5k8LvJuXxZuxx+DAJuXxZpCGViBcKyLxJmJuXxZuxx+DAJuXxZo:jRbme6Am5hiBSmme6Am4

Score

7^/10

upx

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1396	ab61877aeba85f2299873654cb2f3990.exe

Executes dropped EXE 1 IoCs

pid	Process
1396	ab61877aeba85f2299873654cb2f3990.exe

Loads dropped DLL 1 IoCs

pid	Process
1368	ab61877aeba85f2299873654cb2f3990.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1368-0-0x0000000000400000-0x00000000008EF000-memory.dmp	upx
behavioral1/files/0x000c000000012240-10.dat	upx
behavioral1/files/0x000c000000012240-15.dat	upx
behavioral1/memory/1396-16-0x0000000000400000-0x00000000008EF000-memory.dmp	upx

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1368	ab61877aeba85f2299873654cb2f3990.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
1368	ab61877aeba85f2299873654cb2f3990.exe
1396	ab61877aeba85f2299873654cb2f3990.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1368 wrote to memory of 1396	1368	ab61877aeba85f2299873654cb2f3990.exe	28
PID 1368 wrote to memory of 1396	1368	ab61877aeba85f2299873654cb2f3990.exe	28
PID 1368 wrote to memory of 1396	1368	ab61877aeba85f2299873654cb2f3990.exe	28
PID 1368 wrote to memory of 1396	1368	ab61877aeba85f2299873654cb2f3990.exe	28

C:\Users\Admin\AppData\Local\Temp\ab61877aeba85f2299873654cb2f3990.exe
"C:\Users\Admin\AppData\Local\Temp\ab61877aeba85f2299873654cb2f3990.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1368
- C:\Users\Admin\AppData\Local\Temp\ab61877aeba85f2299873654cb2f3990.exe
  C:\Users\Admin\AppData\Local\Temp\ab61877aeba85f2299873654cb2f3990.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:1396

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\ab61877aeba85f2299873654cb2f3990.exe

Filesize
1.2MB

MD5
1cdadca4bceb80bbba4eb398a701c070

SHA1
173814acd5e604ed7d67a5be74e0aece239813ec

SHA256
8196099bd82e4b768953536b042c26c25a2b85ba442c8af8f3beb36511907c0b

SHA512
47d63e8c59937635ac9b626351d26199c217c91eccabbd07ecb034ec66fe4740fc0aa85101eebb89af6943317b123d54d416b2c88f271dce4cd780e95118dcee

Download Submit
\Users\Admin\AppData\Local\Temp\ab61877aeba85f2299873654cb2f3990.exe

Filesize
1.6MB

MD5
bd1d011d0dbb2982edb378eda69e0b4f

SHA1
22e6f06430c426d2341055cd298efb6e0b9749fd

SHA256
ef3b3eb1d941db646ce53935266ad76661bf3fec95ace15298bd1523ba3aac7e

SHA512
e2084b8690660b7308032ca42e22b80fc1985d24ceabfa0f37135e73e43fde0eb76c7c1ba4ed9dd447e300dae4cfe8bb5fcfa7cad96d5451f8ea649e1328d371

Download Submit
memory/1368-31-0x00000000049D0000-0x0000000004EBF000-memory.dmp

Filesize
4.9MB

Download
memory/1368-2-0x0000000000250000-0x0000000000383000-memory.dmp

Filesize
1.2MB

Download
memory/1368-1-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/1368-14-0x00000000049D0000-0x0000000004EBF000-memory.dmp

Filesize
4.9MB

Download
memory/1368-0-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/1368-13-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/1396-16-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/1396-17-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/1396-23-0x0000000000400000-0x000000000061D000-memory.dmp

Filesize
2.1MB

Download
memory/1396-24-0x0000000003550000-0x000000000377A000-memory.dmp

Filesize
2.2MB

Download
memory/1396-18-0x00000000002C0000-0x00000000003F3000-memory.dmp

Filesize
1.2MB

Download
memory/1396-32-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download