395b6e9ca35b0f2383e8e5df7e0b481a2435d60fa3dbc48e755982a55dc81d86

Analysis

max time kernel
127s
max time network
132s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
07-03-2024 22:58

Target

b9e19791afc828381d95be48bbdff620.exe
Size

24KB
MD5

b9e19791afc828381d95be48bbdff620
SHA1

bff2f1fff765af9133838a4062c31b8f04c82682
SHA256

395b6e9ca35b0f2383e8e5df7e0b481a2435d60fa3dbc48e755982a55dc81d86
SHA512

6a2dba1c4a6627b5e27a81e67adcccd63fef585e05c6fb4f90ee5ae6c68c07855286aa475f7958ac58a0dc2ca084079500e8e803962444c73cd011ef3c150b77
SSDEEP

384:nc5J1OSQ3wsvsItXMSlusoXeMhFW/u3eLAjZuHZJ/llHswzY8vt13V5KgljANN:c5bOS0+CcSluso4u3xtu5J/LMVebe

Score

7^/10

upx

Deletes itself 1 IoCs

pid	Process
2284	cmd.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1960-0-0x0000000000400000-0x0000000000414000-memory.dmp	upx
behavioral1/memory/2368-4-0x0000000000400000-0x0000000000414000-memory.dmp	upx
behavioral1/memory/2368-5-0x0000000000400000-0x0000000000414000-memory.dmp	upx
behavioral1/memory/2368-6-0x0000000000400000-0x0000000000414000-memory.dmp	upx
behavioral1/memory/1960-14-0x0000000000400000-0x0000000000414000-memory.dmp	upx
behavioral1/memory/2368-16-0x0000000000400000-0x0000000000414000-memory.dmp	upx

Unexpected DNS network traffic destination 4 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

Drops file in System32 directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\svchost.exe:ext.exe	b9e19791afc828381d95be48bbdff620.exe
File created	C:\Windows\SysWOW64\fci.exe.exe:ext.exe	b9e19791afc828381d95be48bbdff620.exe
File opened for modification	C:\Windows\SysWOW64\fci.exe.exe:ext.exe	b9e19791afc828381d95be48bbdff620.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1960 set thread context of 2368	1960	b9e19791afc828381d95be48bbdff620.exe	28

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1960 wrote to memory of 2368	1960	b9e19791afc828381d95be48bbdff620.exe	28
PID 1960 wrote to memory of 2368	1960	b9e19791afc828381d95be48bbdff620.exe	28
PID 1960 wrote to memory of 2368	1960	b9e19791afc828381d95be48bbdff620.exe	28
PID 1960 wrote to memory of 2368	1960	b9e19791afc828381d95be48bbdff620.exe	28
PID 1960 wrote to memory of 2368	1960	b9e19791afc828381d95be48bbdff620.exe	28
PID 1960 wrote to memory of 2284	1960	b9e19791afc828381d95be48bbdff620.exe	29
PID 1960 wrote to memory of 2284	1960	b9e19791afc828381d95be48bbdff620.exe	29
PID 1960 wrote to memory of 2284	1960	b9e19791afc828381d95be48bbdff620.exe	29
PID 1960 wrote to memory of 2284	1960	b9e19791afc828381d95be48bbdff620.exe	29

C:\Users\Admin\AppData\Local\Temp\b9e19791afc828381d95be48bbdff620.exe
"C:\Users\Admin\AppData\Local\Temp\b9e19791afc828381d95be48bbdff620.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1960
- C:\Windows\SysWOW64\svchost.exe
  svchost.exe
  2⤵
  PID:2368
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Users\Admin\AppData\Local\Temp\2228227.bat
  2⤵
  - Deletes itself
  PID:2284

C:\Users\Admin\AppData\Local\Temp\2228227.bat

Filesize
235B

MD5
103ebef2d885a20085e667b2e1c81ebd

SHA1
547de353a6f60719d588ab93a47cf10dd8661467

SHA256
48fb9b872b71aa2a181ddba73edfae888de35186d75e3bf002666f195eb2f2a0

SHA512
5f987c492de3f4730c1f5c72f9d6f54a7bc1f7b4ba199607be93e3c3101ee05800b0031f7dbbd41df47c8885b09f4c6e4e00a6c78e1144cebe1320a01b81bc3a

Download Submit
memory/1960-0-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1960-14-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2368-1-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2368-4-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2368-5-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2368-6-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2368-16-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download