2cc5027cf8b920db1a6662555732b504ef92db8ef094cbc86595c74a94d1dee2

Analysis

max time kernel
119s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
06/03/2024, 06:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b6ca3c9a3f956dfb0bb06675a07cb2d1.exe
Size

7.8MB
MD5

b6ca3c9a3f956dfb0bb06675a07cb2d1
SHA1

57975e737d952f9d8543f1ffb9e3731e9e809e27
SHA256

2cc5027cf8b920db1a6662555732b504ef92db8ef094cbc86595c74a94d1dee2
SHA512

3e06cce72479772fc1ccd87129d44741bd3a43386fa65a52f3e22301aff335ab514764dc6c27d1d5a8874a51cc8b3177702f6d9aa79122cdd2c8709ef3c28ebd
SSDEEP

98304:ll6Nn4c0gg3gnl/IVURsHzyHgg3gnl/IVUyVWwW7Maulfigg3gnl/IVURsHzyHg/:lltBgl/ibulgl/ilVW3ngl/ibulgl/iG

Score

7^/10

upx

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1496	b6ca3c9a3f956dfb0bb06675a07cb2d1.exe

Executes dropped EXE 1 IoCs

pid	Process
1496	b6ca3c9a3f956dfb0bb06675a07cb2d1.exe

Loads dropped DLL 1 IoCs

pid	Process
2808	b6ca3c9a3f956dfb0bb06675a07cb2d1.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2808-0-0x0000000000400000-0x00000000008EF000-memory.dmp	upx
behavioral1/files/0x000a000000014a94-10.dat	upx
behavioral1/files/0x000a000000014a94-14.dat	upx
behavioral1/memory/1496-17-0x0000000000400000-0x00000000008EF000-memory.dmp	upx

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2808	b6ca3c9a3f956dfb0bb06675a07cb2d1.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2808	b6ca3c9a3f956dfb0bb06675a07cb2d1.exe
1496	b6ca3c9a3f956dfb0bb06675a07cb2d1.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2808 wrote to memory of 1496	2808	b6ca3c9a3f956dfb0bb06675a07cb2d1.exe	28
PID 2808 wrote to memory of 1496	2808	b6ca3c9a3f956dfb0bb06675a07cb2d1.exe	28
PID 2808 wrote to memory of 1496	2808	b6ca3c9a3f956dfb0bb06675a07cb2d1.exe	28
PID 2808 wrote to memory of 1496	2808	b6ca3c9a3f956dfb0bb06675a07cb2d1.exe	28

C:\Users\Admin\AppData\Local\Temp\b6ca3c9a3f956dfb0bb06675a07cb2d1.exe
"C:\Users\Admin\AppData\Local\Temp\b6ca3c9a3f956dfb0bb06675a07cb2d1.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2808
- C:\Users\Admin\AppData\Local\Temp\b6ca3c9a3f956dfb0bb06675a07cb2d1.exe
  C:\Users\Admin\AppData\Local\Temp\b6ca3c9a3f956dfb0bb06675a07cb2d1.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:1496

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\b6ca3c9a3f956dfb0bb06675a07cb2d1.exe

Filesize
808KB

MD5
0e06d6af14307be52fdae592a30c01f0

SHA1
3ef4d2d3ce5953b40f0a1ae56127da9be76151a0

SHA256
2f872cfd43d5b2d67cedbeef7452bfd12080c1bd96633994d8be4b8c2142e12c

SHA512
3a154e1583701b4bc9534add83bc5cd494c9490f35a4c84f958138ca4ea527c8eff999181f50bdc7a63129b1e8d3820100f7e1afa1d71006e2a56e0e936b60aa

Download Submit
\Users\Admin\AppData\Local\Temp\b6ca3c9a3f956dfb0bb06675a07cb2d1.exe

Filesize
948KB

MD5
bd87ed47694d0192e04c2ae2360c1279

SHA1
6a85ed958f711938328ad00dbedc9b990ba3a52b

SHA256
2aef2193bf985bff597967a554e17cd17fff1178ea8a3a1e37300fcc00661e0d

SHA512
0003d99b1dfc280966f94c7f2e36528370dd2926eea0e412b6256ed170d84e2f33859a61a23c13b72162a2e7216f98acc3e710622be1474345b81d238d9c811c

Download Submit
memory/1496-16-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/1496-17-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/1496-19-0x0000000001B20000-0x0000000001C53000-memory.dmp

Filesize
1.2MB

Download
memory/1496-24-0x00000000035A0000-0x00000000037CA000-memory.dmp

Filesize
2.2MB

Download
memory/1496-23-0x0000000000400000-0x000000000061D000-memory.dmp

Filesize
2.1MB

Download
memory/1496-32-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/2808-2-0x0000000001B20000-0x0000000001C53000-memory.dmp

Filesize
1.2MB

Download
memory/2808-15-0x00000000041B0000-0x000000000469F000-memory.dmp

Filesize
4.9MB

Download
memory/2808-1-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/2808-13-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/2808-0-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/2808-31-0x00000000041B0000-0x000000000469F000-memory.dmp

Filesize
4.9MB

Download