Analysis

  • max time kernel
    121s
  • max time network
    142s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    10/03/2024, 01:31

General

  • Target

    bd4f3cb0a645a241407c60ee0839de78.exe

  • Size

    10.0MB

  • MD5

    bd4f3cb0a645a241407c60ee0839de78

  • SHA1

    a107266c52cf704d8ef2712f804986b9673c8462

  • SHA256

    2be3ddd612374925a1b3997dfc1ccdfee89aaf42d21306c35a4832d8d43c9232

  • SHA512

    f965e53ba95eb40b183aec7b90daf600e42906059e39d403c5c13d90703b77619c4994edef02b7b46e40708c22fc8779611ad1501feca81c0edea2a8fbeef159

  • SSDEEP

    98304:VgV/WsCwMni/yEgVCc1fBC83iGGoDKdc+DVCc1fBC:sesCw9/yLMc1pC0ioudc+DMc1pC

Score
7/10
upx

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Modifies system certificate store 2 TTPs 4 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\bd4f3cb0a645a241407c60ee0839de78.exe
    "C:\Users\Admin\AppData\Local\Temp\bd4f3cb0a645a241407c60ee0839de78.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: RenamesItself
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:2360
    • C:\Users\Admin\AppData\Local\Temp\bd4f3cb0a645a241407c60ee0839de78.exe
      C:\Users\Admin\AppData\Local\Temp\bd4f3cb0a645a241407c60ee0839de78.exe
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Modifies system certificate store
      • Suspicious use of UnmapMainImage
      PID:2536

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\bd4f3cb0a645a241407c60ee0839de78.exe

    Filesize

    5.1MB

    MD5

    ec5a8c79e4552c7da7c8558537bfec46

    SHA1

    e049e45489fea77c9fa5d9250647c8423cca48e7

    SHA256

    be497994b06c11a2a52a1b3b7effb19a079c56a3c93fa72b66a8f077a8abba89

    SHA512

    a25b62c3da8fe6caf1ac121ad995a7c6e00fc5e4b7c4ab1f1aba40386f4b0a6239970fef7c8e3e26e868f06c8551142d2044b958ddfd9d42f8313bfbd4a305d6

  • \Users\Admin\AppData\Local\Temp\bd4f3cb0a645a241407c60ee0839de78.exe

    Filesize

    4.4MB

    MD5

    69508d6299099fc32700532eb78e0442

    SHA1

    21b28fa66c73ca199125b938a6ec7451592be303

    SHA256

    3b56ac88aa44da862776cc73f3a9dfbdc0d7611ba313041e14b8bea73b7e8675

    SHA512

    9641a2ea8ba259db0b1e5dbd399955389128616fa85680a34f28bcfaae9f639084f30cb6893865e1a0b0633aa2c79b12056f16c1b41c82bc12328793507760c9

  • memory/2360-1-0x0000000000400000-0x0000000000CE1000-memory.dmp

    Filesize

    8.9MB

  • memory/2360-3-0x0000000002120000-0x000000000234E000-memory.dmp

    Filesize

    2.2MB

  • memory/2360-0-0x0000000000400000-0x00000000005EF000-memory.dmp

    Filesize

    1.9MB

  • memory/2360-15-0x0000000000400000-0x00000000005EF000-memory.dmp

    Filesize

    1.9MB

  • memory/2360-16-0x0000000004B70000-0x0000000005451000-memory.dmp

    Filesize

    8.9MB

  • memory/2536-18-0x0000000000400000-0x0000000000CE1000-memory.dmp

    Filesize

    8.9MB

  • memory/2536-20-0x00000000021B0000-0x00000000023DE000-memory.dmp

    Filesize

    2.2MB

  • memory/2536-43-0x0000000000400000-0x0000000000CE1000-memory.dmp

    Filesize

    8.9MB