2b29a55fd33f11abae79b2ab242c607bc13bd1b93a53be8c6ce6d68c7ffee149

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
07/03/2024, 19:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b9822d79aceec25846f854a9895424d9.exe
Size

2.4MB
MD5

b9822d79aceec25846f854a9895424d9
SHA1

5dabb80b0ba5afc09f8499467877ba9048125e89
SHA256

2b29a55fd33f11abae79b2ab242c607bc13bd1b93a53be8c6ce6d68c7ffee149
SHA512

f2ae93ea57d1a8de2549452403ccac39cb08fe09e7a4121a3cb6505047f481cbcec70c73bb4f5c0f3b259b16a8f79da8445e2d9243a4ed28c732bc96c974c202
SSDEEP

49152:Ku02FZ+cIBhVH8zqmPPD+vrP4M338dB2IBlGuuDVUsdxxjr:0c+P/cmmXDQgg3gnl/IVUs1jr

Score

7^/10

upx

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2648	b9822d79aceec25846f854a9895424d9.exe

Executes dropped EXE 1 IoCs

pid	Process
2648	b9822d79aceec25846f854a9895424d9.exe

Loads dropped DLL 1 IoCs

pid	Process
2368	b9822d79aceec25846f854a9895424d9.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2368-1-0x0000000000400000-0x00000000008EF000-memory.dmp	upx
behavioral1/files/0x000d000000012256-10.dat	upx
behavioral1/files/0x000d000000012256-12.dat	upx
behavioral1/files/0x000d000000012256-14.dat	upx

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2368	b9822d79aceec25846f854a9895424d9.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2368	b9822d79aceec25846f854a9895424d9.exe
2648	b9822d79aceec25846f854a9895424d9.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2368 wrote to memory of 2648	2368	b9822d79aceec25846f854a9895424d9.exe	28
PID 2368 wrote to memory of 2648	2368	b9822d79aceec25846f854a9895424d9.exe	28
PID 2368 wrote to memory of 2648	2368	b9822d79aceec25846f854a9895424d9.exe	28
PID 2368 wrote to memory of 2648	2368	b9822d79aceec25846f854a9895424d9.exe	28

C:\Users\Admin\AppData\Local\Temp\b9822d79aceec25846f854a9895424d9.exe
"C:\Users\Admin\AppData\Local\Temp\b9822d79aceec25846f854a9895424d9.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2368
- C:\Users\Admin\AppData\Local\Temp\b9822d79aceec25846f854a9895424d9.exe
  C:\Users\Admin\AppData\Local\Temp\b9822d79aceec25846f854a9895424d9.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:2648

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\b9822d79aceec25846f854a9895424d9.exe

Filesize
768KB

MD5
35bd1687a58aa0a79fc5f1618fb92285

SHA1
01e98890b56ce20fe6424cba4f05cc9cf82881ae

SHA256
c7703de6ef923e5979a33a3f4fa05b7ea8164bfa5cddc7936b530e3477c1dca1

SHA512
650725cf1ca8bdb13ee9ee457e0e562c36384571e97bbfd7471a273f9ef9a66d6b48203393974c806956af4b14d711a21314a224e97497a5ed6db7e12db9d84e

Download Submit
C:\Users\Admin\AppData\Local\Temp\b9822d79aceec25846f854a9895424d9.exe

Filesize
2.4MB

MD5
4bfc135b53fb7397e725c888b023a857

SHA1
8a78a447f48be91f923c4182683a0d3baaa2407f

SHA256
46fc63463709b218bf2a64e959bf95e2702f1b445125984700d5db5bda8dbb3f

SHA512
9639055a2d9ee985935f90d6eaa633a00f0973eb971f68fa20ddd9185f8808cf8cbda954351c06db100de793cd937ccb236e42fc59d0a3c7ec4cec1906c0ba64

Download Submit
\Users\Admin\AppData\Local\Temp\b9822d79aceec25846f854a9895424d9.exe

Filesize
704KB

MD5
1b4ecbe9f19bc6513c073080c146dd1d

SHA1
681e799df653eb463d71ac2befb35ef48b498ac3

SHA256
3cde30aff965cce50b2068f73e440beb38409f29b319a58ca455ffd4dc25abca

SHA512
f9784e05c544c1842d87e3f3e41e9a4f47528720e40590ac7d6be0e739438d7bbcb348df18ebccd344ea183b3c3d6478f80bba82dbfcf8e6168aa79580748d95

Download Submit
memory/2368-0-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/2368-3-0x0000000001B20000-0x0000000001C53000-memory.dmp

Filesize
1.2MB

Download
memory/2368-13-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/2368-1-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/2648-15-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/2648-16-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/2648-18-0x0000000000270000-0x00000000003A3000-memory.dmp

Filesize
1.2MB

Download
memory/2648-23-0x0000000003500000-0x000000000372A000-memory.dmp

Filesize
2.2MB

Download
memory/2648-22-0x0000000000400000-0x000000000061D000-memory.dmp

Filesize
2.1MB

Download
memory/2648-30-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download