4e775d47e7a6e401d5371d459db324705cf42cfaa91dc7cc9ad9320f618e546c

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
06-03-2024 08:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b6fa8a485d69ddb69376348afd00a773.exe
Size

1.5MB
MD5

b6fa8a485d69ddb69376348afd00a773
SHA1

970784e8e54018493138c7f603386b3da9609bb3
SHA256

4e775d47e7a6e401d5371d459db324705cf42cfaa91dc7cc9ad9320f618e546c
SHA512

98ef96d0cb77768cf3120adf771ad245bba64e7d84d6dfd2c63a55f3fbf5a0fcc04fd2fd44044691dadea57c3adafc33f3463d82d4af525cee1ca29df38623b8
SSDEEP

24576:Hf2y1NgRVsdbQSHPlu7q1XV788DQrHoZWm4hjMZI5z9lLmNlxW:71en4QiMm1Xt88UrHoZWmMjMZ8hpmNr

Score

7^/10

upx

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2524	b6fa8a485d69ddb69376348afd00a773.exe

Executes dropped EXE 1 IoCs

pid	Process
2524	b6fa8a485d69ddb69376348afd00a773.exe

Loads dropped DLL 1 IoCs

pid	Process
2040	b6fa8a485d69ddb69376348afd00a773.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2040-0-0x0000000000400000-0x00000000008EF000-memory.dmp	upx
behavioral1/files/0x000d000000012321-13.dat	upx

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2040	b6fa8a485d69ddb69376348afd00a773.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2040	b6fa8a485d69ddb69376348afd00a773.exe
2524	b6fa8a485d69ddb69376348afd00a773.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2040 wrote to memory of 2524	2040	b6fa8a485d69ddb69376348afd00a773.exe	28
PID 2040 wrote to memory of 2524	2040	b6fa8a485d69ddb69376348afd00a773.exe	28
PID 2040 wrote to memory of 2524	2040	b6fa8a485d69ddb69376348afd00a773.exe	28
PID 2040 wrote to memory of 2524	2040	b6fa8a485d69ddb69376348afd00a773.exe	28

C:\Users\Admin\AppData\Local\Temp\b6fa8a485d69ddb69376348afd00a773.exe
"C:\Users\Admin\AppData\Local\Temp\b6fa8a485d69ddb69376348afd00a773.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2040
- C:\Users\Admin\AppData\Local\Temp\b6fa8a485d69ddb69376348afd00a773.exe
  C:\Users\Admin\AppData\Local\Temp\b6fa8a485d69ddb69376348afd00a773.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:2524

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\b6fa8a485d69ddb69376348afd00a773.exe

Filesize
1.5MB

MD5
a83afd4e80ed2b71b2cdc94bba89a48f

SHA1
409ced72234575e198b745b4545332faa60a433d

SHA256
da24d53db45238cc05ea250c8335597453d6ae83f0f8b7e2fc4aa75969c24886

SHA512
c549009ed59720211203db26b2fed0c509647ac503b0cab13d4c3ad50db2b5f91b32f2670480a23409ff6a2c598d665323f9bd15e0c1dcd2a3391c017fcac026

Download Submit
memory/2040-14-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/2040-2-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/2040-1-0x0000000000130000-0x0000000000263000-memory.dmp

Filesize
1.2MB

Download
memory/2040-0-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/2040-16-0x0000000003530000-0x0000000003A1F000-memory.dmp

Filesize
4.9MB

Download
memory/2040-31-0x0000000003530000-0x0000000003A1F000-memory.dmp

Filesize
4.9MB

Download
memory/2524-15-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/2524-18-0x0000000001B20000-0x0000000001C53000-memory.dmp

Filesize
1.2MB

Download
memory/2524-20-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/2524-23-0x0000000000400000-0x000000000061D000-memory.dmp

Filesize
2.1MB

Download
memory/2524-24-0x0000000003410000-0x000000000363A000-memory.dmp

Filesize
2.2MB

Download
memory/2524-32-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download