Analysis

  • max time kernel
    149s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07-03-2024 23:24

General

  • Target

    b9ecbe3169d2867abd63f85c9045dbae.exe

  • Size

    2.6MB

  • MD5

    b9ecbe3169d2867abd63f85c9045dbae

  • SHA1

    f5f54c116c9a10bd33334adeacd43377cff25da2

  • SHA256

    e7715202b6160e25fd08f69ed0b69ffcbdc9dc475d37cb3f1c7b06fd847da510

  • SHA512

    a630bcd2093ca93a5902d42455d365f7670ef941499a82ab9fd22aa73ff1b3b2f8eeb6772a797b6dba465bd4d07b937219111770d17072425a38f5299955756e

  • SSDEEP

    49152:G6LARZsIL/3tAFbph6RA+Jxw0PszAXuVgQay3:oXsC7R7w0GGI3

Score
7/10
upx

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Modifies system certificate store 2 TTPs 5 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b9ecbe3169d2867abd63f85c9045dbae.exe
    "C:\Users\Admin\AppData\Local\Temp\b9ecbe3169d2867abd63f85c9045dbae.exe"
    1⤵
    • Suspicious behavior: RenamesItself
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:2284
    • C:\Users\Admin\AppData\Local\Temp\b9ecbe3169d2867abd63f85c9045dbae.exe
      C:\Users\Admin\AppData\Local\Temp\b9ecbe3169d2867abd63f85c9045dbae.exe
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Modifies system certificate store
      • Suspicious use of UnmapMainImage
      PID:4700

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\b9ecbe3169d2867abd63f85c9045dbae.exe

    Filesize

    1.5MB

    MD5

    36c40d94508a4fa5661ee6e0a3e32fa1

    SHA1

    d751d68834d7b3949767fd1cccf930fc7b833e24

    SHA256

    1e210c907c157145a6f5bc72da0de6a3f06d75074cdfe3a7e0d2fb6ddf7d34c5

    SHA512

    53f873c3e95d1ea16166ee202f4345e947b19e3bdced9ba71542986b27d851ebdeaa18c8afed6f00a300ad69ac113bc3995ab4032581ce53e0a4fb0854e47b09

  • memory/2284-0-0x0000000000400000-0x0000000000D9E000-memory.dmp

    Filesize

    9.6MB

  • memory/2284-2-0x0000000000400000-0x0000000000605000-memory.dmp

    Filesize

    2.0MB

  • memory/2284-1-0x0000000002370000-0x00000000025CA000-memory.dmp

    Filesize

    2.4MB

  • memory/2284-13-0x0000000000400000-0x0000000000605000-memory.dmp

    Filesize

    2.0MB

  • memory/4700-15-0x0000000000400000-0x0000000000D9E000-memory.dmp

    Filesize

    9.6MB

  • memory/4700-17-0x0000000002360000-0x00000000025BA000-memory.dmp

    Filesize

    2.4MB

  • memory/4700-30-0x0000000000400000-0x0000000000D9E000-memory.dmp

    Filesize

    9.6MB