7bc612857960ee81faec1f586dc5ba438dc1f3155e4caaa49593e16f2d8d9f55

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
08/03/2024, 16:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

bbaf44f931cd67829cdfb0d9b87eca6a.exe
Size

5.8MB
MD5

bbaf44f931cd67829cdfb0d9b87eca6a
SHA1

b8f8c4948811137e2ccc6fec0ee0e0bfa6c1d6af
SHA256

7bc612857960ee81faec1f586dc5ba438dc1f3155e4caaa49593e16f2d8d9f55
SHA512

25a569c1821952b8957c78a249adf68f62cb4c4c1d2f1bd1fe21045749197e3afc490c5ed48c2ab4eef5b953c48e1811edc0569adf75f48fdc2bcc02eb10fff9
SSDEEP

98304:gjytkb/n+3buWS6gg3gnl/IVUs1jePsELEDMLvXXcLccNgg3gnl/IVUs1jePs:btE/n+3Kugl/iBiP5XXyccLgl/iBiP

Score

7^/10

upx

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1216	bbaf44f931cd67829cdfb0d9b87eca6a.exe

Executes dropped EXE 1 IoCs

pid	Process
1216	bbaf44f931cd67829cdfb0d9b87eca6a.exe

Loads dropped DLL 1 IoCs

pid	Process
1712	bbaf44f931cd67829cdfb0d9b87eca6a.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1712-0-0x0000000000400000-0x00000000008EF000-memory.dmp	upx
behavioral1/files/0x0009000000014120-13.dat	upx

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1712	bbaf44f931cd67829cdfb0d9b87eca6a.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
1712	bbaf44f931cd67829cdfb0d9b87eca6a.exe
1216	bbaf44f931cd67829cdfb0d9b87eca6a.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1712 wrote to memory of 1216	1712	bbaf44f931cd67829cdfb0d9b87eca6a.exe	28
PID 1712 wrote to memory of 1216	1712	bbaf44f931cd67829cdfb0d9b87eca6a.exe	28
PID 1712 wrote to memory of 1216	1712	bbaf44f931cd67829cdfb0d9b87eca6a.exe	28
PID 1712 wrote to memory of 1216	1712	bbaf44f931cd67829cdfb0d9b87eca6a.exe	28

C:\Users\Admin\AppData\Local\Temp\bbaf44f931cd67829cdfb0d9b87eca6a.exe
"C:\Users\Admin\AppData\Local\Temp\bbaf44f931cd67829cdfb0d9b87eca6a.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1712
- C:\Users\Admin\AppData\Local\Temp\bbaf44f931cd67829cdfb0d9b87eca6a.exe
  C:\Users\Admin\AppData\Local\Temp\bbaf44f931cd67829cdfb0d9b87eca6a.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:1216

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\bbaf44f931cd67829cdfb0d9b87eca6a.exe

Filesize
5.8MB

MD5
1d318b54903d2702de9d617f18140fde

SHA1
3e1fc74cf4a114f3735e6b2a28cb02504f10fca0

SHA256
2e475a46d1add19fca91564085c1b14872da7a895fe5f65ea0152c72899e09ca

SHA512
7b10ac01fa66b7e4c79e80aedb858567cf2ac2c48b421f5404753aa0d0fd040fd67cc0f901ab85fc4efa8eea94da4acf3d41d9589c1f6d7943e960708bc0ae25

Download Submit
memory/1216-18-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/1216-16-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/1216-20-0x0000000001B20000-0x0000000001C53000-memory.dmp

Filesize
1.2MB

Download
memory/1216-23-0x0000000000400000-0x000000000061D000-memory.dmp

Filesize
2.1MB

Download
memory/1216-25-0x0000000003410000-0x000000000363A000-memory.dmp

Filesize
2.2MB

Download
memory/1216-32-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/1712-2-0x00000000018F0000-0x0000000001A23000-memory.dmp

Filesize
1.2MB

Download
memory/1712-1-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/1712-14-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/1712-0-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/1712-15-0x0000000003F20000-0x000000000440F000-memory.dmp

Filesize
4.9MB

Download
memory/1712-31-0x0000000003F20000-0x000000000440F000-memory.dmp

Filesize
4.9MB

Download