6685e2bad5903f3b07f92e1965794268c5969aafdbaefc44c04c38a7cbfbab79

Analysis

max time kernel
118s
max time network
127s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
07/03/2024, 16:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b9330b60f33308a0885b2bbcb043dd0f.exe
Size

1.3MB
MD5

b9330b60f33308a0885b2bbcb043dd0f
SHA1

6dee5a85c0c719930955db7370e877c0b7479b5b
SHA256

6685e2bad5903f3b07f92e1965794268c5969aafdbaefc44c04c38a7cbfbab79
SHA512

9cb997f910601095559c00f2f93fbfacfa30064cca9673035f39c104b7c906c0ed152bdbe009465ac1c41e44e449397884776ab59e497a2d89b2d380ff1f8666
SSDEEP

24576:1vYIS8XVpb0MGz4jZzgoq3zpkIrXX8iiU8wY6vYSQpGdpb3vG:1vYLaj0XyNgqIrVpVQS+Gdp

Score

7^/10

upx

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2632	b9330b60f33308a0885b2bbcb043dd0f.exe

Executes dropped EXE 1 IoCs

pid	Process
2632	b9330b60f33308a0885b2bbcb043dd0f.exe

Loads dropped DLL 1 IoCs

pid	Process
1336	b9330b60f33308a0885b2bbcb043dd0f.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1336-0-0x0000000000400000-0x000000000086A000-memory.dmp	upx
behavioral1/files/0x000c00000001224c-11.dat	upx
behavioral1/memory/1336-13-0x00000000032D0000-0x000000000373A000-memory.dmp	upx
behavioral1/files/0x000c00000001224c-15.dat	upx
behavioral1/memory/2632-18-0x0000000000400000-0x000000000086A000-memory.dmp	upx

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1336	b9330b60f33308a0885b2bbcb043dd0f.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
1336	b9330b60f33308a0885b2bbcb043dd0f.exe
2632	b9330b60f33308a0885b2bbcb043dd0f.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1336 wrote to memory of 2632	1336	b9330b60f33308a0885b2bbcb043dd0f.exe	28
PID 1336 wrote to memory of 2632	1336	b9330b60f33308a0885b2bbcb043dd0f.exe	28
PID 1336 wrote to memory of 2632	1336	b9330b60f33308a0885b2bbcb043dd0f.exe	28
PID 1336 wrote to memory of 2632	1336	b9330b60f33308a0885b2bbcb043dd0f.exe	28

C:\Users\Admin\AppData\Local\Temp\b9330b60f33308a0885b2bbcb043dd0f.exe
"C:\Users\Admin\AppData\Local\Temp\b9330b60f33308a0885b2bbcb043dd0f.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1336
- C:\Users\Admin\AppData\Local\Temp\b9330b60f33308a0885b2bbcb043dd0f.exe
  C:\Users\Admin\AppData\Local\Temp\b9330b60f33308a0885b2bbcb043dd0f.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:2632

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\b9330b60f33308a0885b2bbcb043dd0f.exe

Filesize
1.3MB

MD5
4c74a5f649f47c7ea731edcd7e09e7a1

SHA1
e687b3aa9f7fc771f335b68812c2844c6a598b1b

SHA256
e21c5028875a6995dde8f512a7e91544396b6a916eeb4416270889f5aabbe25b

SHA512
bbc9319e7004e7a830fa766cd1efab14f57efbcc02a6b086a64ba4fc19e901d6071ab1f78833b6516f4df9c8db95b7be5952bb2b66eb4a3fb17624616cd5437b

Download Submit
\Users\Admin\AppData\Local\Temp\b9330b60f33308a0885b2bbcb043dd0f.exe

Filesize
384KB

MD5
79840b0c1d4ddc148be1dcdef148d82b

SHA1
c0be4a279c71b38e52b355989231b3d379aa6d19

SHA256
2eba20d5f38441a13171323cfe7a91d3362649cefd7dab84fa7d35f1599e4c4d

SHA512
ab3b5399ca683a4efe38a6bbc546a1a597ff255d36baac53737a1e86606378cfdebcba45a531344fc516f7a8eddc2756d581416722a669e917cda1aa1ede363d

Download Submit
memory/1336-0-0x0000000000400000-0x000000000086A000-memory.dmp

Filesize
4.4MB

Download
memory/1336-1-0x0000000000400000-0x00000000005F2000-memory.dmp

Filesize
1.9MB

Download
memory/1336-2-0x00000000002B0000-0x00000000003C2000-memory.dmp

Filesize
1.1MB

Download
memory/1336-13-0x00000000032D0000-0x000000000373A000-memory.dmp

Filesize
4.4MB

Download
memory/1336-16-0x0000000000400000-0x00000000005F2000-memory.dmp

Filesize
1.9MB

Download
memory/2632-17-0x0000000000400000-0x00000000005F2000-memory.dmp

Filesize
1.9MB

Download
memory/2632-18-0x0000000000400000-0x000000000086A000-memory.dmp

Filesize
4.4MB

Download
memory/2632-20-0x0000000001A60000-0x0000000001B72000-memory.dmp

Filesize
1.1MB

Download
memory/2632-26-0x0000000000400000-0x000000000086A000-memory.dmp

Filesize
4.4MB

Download