6cc3a22fc78149237dc821aec6fb2643d4b7822fea284c54c29f13bb7ebfa71e

Analysis

max time kernel
120s
max time network
127s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
08-03-2024 16:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bbb35740aa745a1bf1d7f7e4b2564070.exe
Size

1.3MB
MD5

bbb35740aa745a1bf1d7f7e4b2564070
SHA1

e2d402953ff50952f85e37713f07cafe7e71ba03
SHA256

6cc3a22fc78149237dc821aec6fb2643d4b7822fea284c54c29f13bb7ebfa71e
SHA512

ef2e971e2be5db8e54856c8d30df2cec426a7e2b337c92d9aaa23cd8c460e17d0b66dab0c26b9dd5e796f8a6d068085467c21aa0894496840a42395c567d7da6
SSDEEP

24576:+wQxEL1EJ0WuSWvQ/wc9kF8tSgsLkmaGJ0gNAlfTGtdbL4z0U9/9Us:SxEwaU9FSHZzAf66R9j

Score

7^/10

upx

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3012	bbb35740aa745a1bf1d7f7e4b2564070.exe

Executes dropped EXE 1 IoCs

pid	Process
3012	bbb35740aa745a1bf1d7f7e4b2564070.exe

Loads dropped DLL 1 IoCs

pid	Process
1440	bbb35740aa745a1bf1d7f7e4b2564070.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1440-0-0x0000000000400000-0x00000000008E7000-memory.dmp	upx
behavioral1/files/0x0008000000012262-10.dat	upx
behavioral1/files/0x0008000000012262-13.dat	upx
behavioral1/files/0x0008000000012262-12.dat	upx
behavioral1/memory/3012-16-0x0000000000400000-0x00000000008E7000-memory.dmp	upx

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1440	bbb35740aa745a1bf1d7f7e4b2564070.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
1440	bbb35740aa745a1bf1d7f7e4b2564070.exe
3012	bbb35740aa745a1bf1d7f7e4b2564070.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1440 wrote to memory of 3012	1440	bbb35740aa745a1bf1d7f7e4b2564070.exe	28
PID 1440 wrote to memory of 3012	1440	bbb35740aa745a1bf1d7f7e4b2564070.exe	28
PID 1440 wrote to memory of 3012	1440	bbb35740aa745a1bf1d7f7e4b2564070.exe	28
PID 1440 wrote to memory of 3012	1440	bbb35740aa745a1bf1d7f7e4b2564070.exe	28

C:\Users\Admin\AppData\Local\Temp\bbb35740aa745a1bf1d7f7e4b2564070.exe
"C:\Users\Admin\AppData\Local\Temp\bbb35740aa745a1bf1d7f7e4b2564070.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1440
- C:\Users\Admin\AppData\Local\Temp\bbb35740aa745a1bf1d7f7e4b2564070.exe
  C:\Users\Admin\AppData\Local\Temp\bbb35740aa745a1bf1d7f7e4b2564070.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:3012

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\bbb35740aa745a1bf1d7f7e4b2564070.exe

Filesize
758KB

MD5
40ca539db3217f50e0fbba7146447600

SHA1
b1441a15777d9c4b240f86856a32783e6b66363c

SHA256
7c4eed8b54d84b9eabcfca41c82ce709ec29b326b94936ed1f76345731eab6a5

SHA512
7fa14ede2f84f28c7a8548ebce16cf90c5aee7f37cea59a1dfd968ce111229e419571d0227d1d1b8a75c15ac1d89dc46a43652ea4ca31abb31710e22a099f396

Download Submit
C:\Users\Admin\AppData\Local\Temp\bbb35740aa745a1bf1d7f7e4b2564070.exe

Filesize
720KB

MD5
9472ea0f96bd0062c71ac789c57934ee

SHA1
d30754fee69a6813470ccfe94f9e9de9ee7a212f

SHA256
2657b9d97369a28f7f020b7c820adb40df0d68ae5f40fe9897b256a7d998dfeb

SHA512
ba6eade0f9291673e05db29b8bd5e0a3c751e3634511f32dcee69302859e1ac7b32acb6c95a38bb8b20d7a177caa646cc908e6a05b335489993bc18bff0c7d91

Download Submit
\Users\Admin\AppData\Local\Temp\bbb35740aa745a1bf1d7f7e4b2564070.exe

Filesize
992KB

MD5
8bb84aefb687b84c9f1182afd449fa99

SHA1
42665435bb33c33cf0f6a1bd4d5d303027ce6729

SHA256
60de9e6af098217c412b2df7b2f007eb42a200ea6d466d6b9187507250576a6a

SHA512
4fac797a30e2bcc00ef558c1c0b9d34a45251987b69544ff833a28d9a1440295f525dff233510982b1331b5ac5472f389ab38e0c0ba45ff94c4326f02eb8c1b5

Download Submit
memory/1440-14-0x0000000000400000-0x0000000000622000-memory.dmp

Filesize
2.1MB

Download
memory/1440-1-0x0000000000400000-0x0000000000622000-memory.dmp

Filesize
2.1MB

Download
memory/1440-2-0x0000000000130000-0x0000000000261000-memory.dmp

Filesize
1.2MB

Download
memory/1440-0-0x0000000000400000-0x00000000008E7000-memory.dmp

Filesize
4.9MB

Download
memory/1440-15-0x00000000034A0000-0x0000000003987000-memory.dmp

Filesize
4.9MB

Download
memory/1440-31-0x00000000034A0000-0x0000000003987000-memory.dmp

Filesize
4.9MB

Download
memory/3012-17-0x0000000000400000-0x0000000000622000-memory.dmp

Filesize
2.1MB

Download
memory/3012-18-0x0000000001B10000-0x0000000001C41000-memory.dmp

Filesize
1.2MB

Download
memory/3012-16-0x0000000000400000-0x00000000008E7000-memory.dmp

Filesize
4.9MB

Download
memory/3012-23-0x0000000000400000-0x0000000000616000-memory.dmp

Filesize
2.1MB

Download
memory/3012-24-0x00000000033F0000-0x0000000003612000-memory.dmp

Filesize
2.1MB

Download
memory/3012-32-0x0000000000400000-0x00000000008E7000-memory.dmp

Filesize
4.9MB

Download