9425565c1c89b1dda680906e4d4454dc1c5201c402046a53ff1a669a91abdf4e

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
05/03/2024, 23:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b5f39df2d1b5863c76b031b8ad046287.exe
Size

1.5MB
MD5

b5f39df2d1b5863c76b031b8ad046287
SHA1

af30e22670423e4cf2a0c337b7525b15142801e0
SHA256

9425565c1c89b1dda680906e4d4454dc1c5201c402046a53ff1a669a91abdf4e
SHA512

fbb426df15ecab475402e6e69d683f90e3facaeced877b51b702be6b613ae1ec61e48d14506cd60a393802cf8385e1e8c21d49a01ca86c34043f9c91e8fbb937
SSDEEP

24576:YO7oouzuacf4xq6vYEDxgBfeRSWno5exPdgH4aRW:p7duzulQx/vbDxwfIXoAxFHI

Score

7^/10

upx

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2156	b5f39df2d1b5863c76b031b8ad046287.exe

Executes dropped EXE 1 IoCs

pid	Process
2156	b5f39df2d1b5863c76b031b8ad046287.exe

Loads dropped DLL 1 IoCs

pid	Process
2880	b5f39df2d1b5863c76b031b8ad046287.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2880-0-0x0000000000400000-0x00000000008EF000-memory.dmp	upx
behavioral1/files/0x000c00000001224e-10.dat	upx

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2880	b5f39df2d1b5863c76b031b8ad046287.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2880	b5f39df2d1b5863c76b031b8ad046287.exe
2156	b5f39df2d1b5863c76b031b8ad046287.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2880 wrote to memory of 2156	2880	b5f39df2d1b5863c76b031b8ad046287.exe	28
PID 2880 wrote to memory of 2156	2880	b5f39df2d1b5863c76b031b8ad046287.exe	28
PID 2880 wrote to memory of 2156	2880	b5f39df2d1b5863c76b031b8ad046287.exe	28
PID 2880 wrote to memory of 2156	2880	b5f39df2d1b5863c76b031b8ad046287.exe	28

C:\Users\Admin\AppData\Local\Temp\b5f39df2d1b5863c76b031b8ad046287.exe
"C:\Users\Admin\AppData\Local\Temp\b5f39df2d1b5863c76b031b8ad046287.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2880
- C:\Users\Admin\AppData\Local\Temp\b5f39df2d1b5863c76b031b8ad046287.exe
  C:\Users\Admin\AppData\Local\Temp\b5f39df2d1b5863c76b031b8ad046287.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:2156

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\b5f39df2d1b5863c76b031b8ad046287.exe

Filesize
1.5MB

MD5
719800b6039405ca7f6d92dd6a68dce1

SHA1
a44d83d70e40e88393caeeed878819025efa93c5

SHA256
7f5aa1e4201160854a023d47d8fb1ffefdc2513f325d7cb1ac762aa9f95f0c2d

SHA512
c97023bd580d2d2d3b61215a2ca7d6d27c97eebf4d07802e5907d2723ab3ec52a523fa6240fa1e33768cfee4b12dd6c58b390f21f815a650bde4a0296058dd3c

Download Submit
memory/2156-23-0x0000000000400000-0x000000000061D000-memory.dmp

Filesize
2.1MB

Download
memory/2156-16-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/2156-17-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/2156-19-0x00000000018F0000-0x0000000001A23000-memory.dmp

Filesize
1.2MB

Download
memory/2156-25-0x0000000003570000-0x000000000379A000-memory.dmp

Filesize
2.2MB

Download
memory/2156-32-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/2880-2-0x00000000002C0000-0x00000000003F3000-memory.dmp

Filesize
1.2MB

Download
memory/2880-1-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/2880-14-0x0000000003650000-0x0000000003B3F000-memory.dmp

Filesize
4.9MB

Download
memory/2880-13-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/2880-0-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/2880-31-0x0000000003650000-0x0000000003B3F000-memory.dmp

Filesize
4.9MB

Download