eb0cdf466f279eedd1238ba55f1b6cd48cc9122edc6d41e2210660f70e1ac916

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
06-03-2024 14:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b7999c13a3a1ceb50c0b108d42599a7d.exe
Size

2.4MB
MD5

b7999c13a3a1ceb50c0b108d42599a7d
SHA1

9b9e784b6cbd5419c1c5e7486849a3ee230ddfad
SHA256

eb0cdf466f279eedd1238ba55f1b6cd48cc9122edc6d41e2210660f70e1ac916
SHA512

6143ba69c734546bb57cdef81743df99ba7d8952240fe1a17b6ea15913c708fab2c1704bd05a31acb979a94267c182fefc2b5e9d081954cfef728f666aea3b94
SSDEEP

49152:Ahcq8smRChJyxw4oOp+sWVwEiR+P4M338dB2IBlGuuDVUsdxxjr:Vq8ghAZqNrgg3gnl/IVUs1jr

Score

7^/10

upx

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1172	b7999c13a3a1ceb50c0b108d42599a7d.exe

Executes dropped EXE 1 IoCs

pid	Process
1172	b7999c13a3a1ceb50c0b108d42599a7d.exe

Loads dropped DLL 1 IoCs

pid	Process
1940	b7999c13a3a1ceb50c0b108d42599a7d.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1940-1-0x0000000000400000-0x00000000008EF000-memory.dmp	upx
behavioral1/files/0x000c00000001225d-12.dat	upx

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1940	b7999c13a3a1ceb50c0b108d42599a7d.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
1940	b7999c13a3a1ceb50c0b108d42599a7d.exe
1172	b7999c13a3a1ceb50c0b108d42599a7d.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1940 wrote to memory of 1172	1940	b7999c13a3a1ceb50c0b108d42599a7d.exe	28
PID 1940 wrote to memory of 1172	1940	b7999c13a3a1ceb50c0b108d42599a7d.exe	28
PID 1940 wrote to memory of 1172	1940	b7999c13a3a1ceb50c0b108d42599a7d.exe	28
PID 1940 wrote to memory of 1172	1940	b7999c13a3a1ceb50c0b108d42599a7d.exe	28

C:\Users\Admin\AppData\Local\Temp\b7999c13a3a1ceb50c0b108d42599a7d.exe
"C:\Users\Admin\AppData\Local\Temp\b7999c13a3a1ceb50c0b108d42599a7d.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1940
- C:\Users\Admin\AppData\Local\Temp\b7999c13a3a1ceb50c0b108d42599a7d.exe
  C:\Users\Admin\AppData\Local\Temp\b7999c13a3a1ceb50c0b108d42599a7d.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:1172

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\b7999c13a3a1ceb50c0b108d42599a7d.exe

Filesize
2.4MB

MD5
ca4bfd60030077a05ddcd9c6dcb77897

SHA1
8a6318f3e73b059243281e462166a87c33863c9c

SHA256
a6e87c0f5f1fbec9755d80f0e4b11f0cf2a83c22c771ccab39a4441b88e3f16e

SHA512
24c15bdb5c643481d17ff2f20ea07aee91b5fedbbcf0cd082cba03e33b56ebd8d45108b823732ca907fadd11cbcb7727be980eecd5748d63d388280492334120

Download Submit
memory/1172-23-0x0000000000400000-0x000000000061D000-memory.dmp

Filesize
2.1MB

Download
memory/1172-17-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/1172-16-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/1172-19-0x0000000000130000-0x0000000000263000-memory.dmp

Filesize
1.2MB

Download
memory/1172-25-0x0000000003400000-0x000000000362A000-memory.dmp

Filesize
2.2MB

Download
memory/1172-32-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/1940-3-0x0000000000130000-0x0000000000263000-memory.dmp

Filesize
1.2MB

Download
memory/1940-13-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/1940-0-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/1940-14-0x00000000036D0000-0x0000000003BBF000-memory.dmp

Filesize
4.9MB

Download
memory/1940-1-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/1940-31-0x00000000036D0000-0x0000000003BBF000-memory.dmp

Filesize
4.9MB

Download