9ace8f97bea06a5bc98b0b1222f0daef184031f9f1080b84dbaa3dbea69ad63f

Analysis

max time kernel
118s
max time network
140s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28/02/2024, 17:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

ac6f7f393a441d5ae162d9f8d6faed85.exe
Size

5.8MB
MD5

ac6f7f393a441d5ae162d9f8d6faed85
SHA1

aa50e6a8939fe51c67889e7f218db14cf87dade3
SHA256

9ace8f97bea06a5bc98b0b1222f0daef184031f9f1080b84dbaa3dbea69ad63f
SHA512

1471b06b7303982b2468680360cd8134ae4930287f55d1bd30771810d26fe128414062e8cdc19a8c005d62a1f4563d1b3616ad4a673692a2118091ae247376b3
SSDEEP

98304:XiCPYpX8wV0Wk4Uv2Hau42c1joCjMPkNwk6alDAqD7z3uboHau42c1joCjMPkNwv:XpYpMu3kuauq1jI86FA7y2auq1jI86

Score

7^/10

upx

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2960	ac6f7f393a441d5ae162d9f8d6faed85.exe

Executes dropped EXE 1 IoCs

pid	Process
2960	ac6f7f393a441d5ae162d9f8d6faed85.exe

Loads dropped DLL 1 IoCs

pid	Process
2156	ac6f7f393a441d5ae162d9f8d6faed85.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2156-0-0x0000000000400000-0x00000000008EF000-memory.dmp	upx
behavioral1/files/0x00040000000130fc-10.dat	upx
behavioral1/files/0x00040000000130fc-15.dat	upx
behavioral1/memory/2960-16-0x0000000000400000-0x00000000008EF000-memory.dmp	upx
behavioral1/memory/2156-14-0x0000000003EF0000-0x00000000043DF000-memory.dmp	upx
behavioral1/files/0x00040000000130fc-12.dat	upx

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2156	ac6f7f393a441d5ae162d9f8d6faed85.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2156	ac6f7f393a441d5ae162d9f8d6faed85.exe
2960	ac6f7f393a441d5ae162d9f8d6faed85.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2156 wrote to memory of 2960	2156	ac6f7f393a441d5ae162d9f8d6faed85.exe	28
PID 2156 wrote to memory of 2960	2156	ac6f7f393a441d5ae162d9f8d6faed85.exe	28
PID 2156 wrote to memory of 2960	2156	ac6f7f393a441d5ae162d9f8d6faed85.exe	28
PID 2156 wrote to memory of 2960	2156	ac6f7f393a441d5ae162d9f8d6faed85.exe	28

C:\Users\Admin\AppData\Local\Temp\ac6f7f393a441d5ae162d9f8d6faed85.exe
"C:\Users\Admin\AppData\Local\Temp\ac6f7f393a441d5ae162d9f8d6faed85.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2156
- C:\Users\Admin\AppData\Local\Temp\ac6f7f393a441d5ae162d9f8d6faed85.exe
  C:\Users\Admin\AppData\Local\Temp\ac6f7f393a441d5ae162d9f8d6faed85.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:2960

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\ac6f7f393a441d5ae162d9f8d6faed85.exe

Filesize
3.3MB

MD5
3c8ce16c7bac8a4c0b85ea4a4659ddf2

SHA1
b6710849451c855496270e78c1c0ace30e3135a9

SHA256
c6cb791b5e71ea371542f8088ee37adc7584d30b65b1158bab99ee1fce96edae

SHA512
147fd30e88b870448f8e48e01899bd6c6969451ed22a134518f1d085140b6e45db3f3ed3935126b505668e95ec7d65c8e25a5825e21d092f92322698cd7cc555

Download Submit
C:\Users\Admin\AppData\Local\Temp\ac6f7f393a441d5ae162d9f8d6faed85.exe

Filesize
3.2MB

MD5
f4458a92189bbd3020526b2cff2670e0

SHA1
dd61270369b3e442ae18751c61a33a8ebac4a5c0

SHA256
898c94a9169ec07e0db67617ee94380d9e02a7a23b78bb12d555f01c114e409a

SHA512
3750ed673dcaa2616107fa8891b4eee389fffedd188642543acbb33c9fa481e01ba74859aeda4268b33ac1c7fc653a5c145c021fa305f186e73a8f862caf0d89

Download Submit
\Users\Admin\AppData\Local\Temp\ac6f7f393a441d5ae162d9f8d6faed85.exe

Filesize
4.9MB

MD5
392ed27619328479eb82b062279b7508

SHA1
64140a974885a227c6371aa4306a7da4d15b078c

SHA256
d5b9fb83b7f0ea41708562488b9f85f71d2e0c00b1f8e3f807d66cafa2343454

SHA512
d0c712510205a9385ca1d2eaa1b92d8db58eca4e719be7a4bc8c851845aa99d8aa95602ac28508d3dff2dffdf6e7399bf9adb36a8c3a4f045af0cd60f2bd2203

Download Submit
memory/2156-14-0x0000000003EF0000-0x00000000043DF000-memory.dmp

Filesize
4.9MB

Download
memory/2156-2-0x00000000002A0000-0x00000000003D3000-memory.dmp

Filesize
1.2MB

Download
memory/2156-0-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/2156-13-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/2156-1-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/2960-16-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/2960-18-0x0000000001B20000-0x0000000001C53000-memory.dmp

Filesize
1.2MB

Download
memory/2960-17-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/2960-24-0x0000000003410000-0x000000000363A000-memory.dmp

Filesize
2.2MB

Download
memory/2960-23-0x0000000000400000-0x000000000061D000-memory.dmp

Filesize
2.1MB

Download
memory/2960-31-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download