9644df7248fdad47baf5756f565acb9b8a1a241804bc8a588cbbd9410c591c99

Analysis

max time kernel
120s
max time network
129s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
11/03/2024, 04:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bfe4f0d29282ed16c45511d97d980608.exe
Size

3.9MB
MD5

bfe4f0d29282ed16c45511d97d980608
SHA1

fe20bce50164f5364ca5ace1ffe7058901782058
SHA256

9644df7248fdad47baf5756f565acb9b8a1a241804bc8a588cbbd9410c591c99
SHA512

c5ae7840bb4a87541c8e81029575b0e0a42e12715ece01631a3d2a6b8823173543a08a677b359703393860a0c7b30c391644fad829346382a88af01135fcee1e
SSDEEP

98304:GfoHvnhPo65QHpgg3gnl/IVUt4pJWzZtIygg3gnl/IVUV:F/q6qPgl/iwgWttJgl/iG

Score

7^/10

upx

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2296	bfe4f0d29282ed16c45511d97d980608.exe

Executes dropped EXE 1 IoCs

pid	Process
2296	bfe4f0d29282ed16c45511d97d980608.exe

Loads dropped DLL 1 IoCs

pid	Process
2236	bfe4f0d29282ed16c45511d97d980608.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2236-0-0x0000000000400000-0x00000000008EF000-memory.dmp	upx
behavioral1/files/0x000900000001223d-10.dat	upx
behavioral1/files/0x000900000001223d-14.dat	upx
behavioral1/memory/2296-16-0x0000000000400000-0x00000000008EF000-memory.dmp	upx

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2236	bfe4f0d29282ed16c45511d97d980608.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2236	bfe4f0d29282ed16c45511d97d980608.exe
2296	bfe4f0d29282ed16c45511d97d980608.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2236 wrote to memory of 2296	2236	bfe4f0d29282ed16c45511d97d980608.exe	28
PID 2236 wrote to memory of 2296	2236	bfe4f0d29282ed16c45511d97d980608.exe	28
PID 2236 wrote to memory of 2296	2236	bfe4f0d29282ed16c45511d97d980608.exe	28
PID 2236 wrote to memory of 2296	2236	bfe4f0d29282ed16c45511d97d980608.exe	28

C:\Users\Admin\AppData\Local\Temp\bfe4f0d29282ed16c45511d97d980608.exe
"C:\Users\Admin\AppData\Local\Temp\bfe4f0d29282ed16c45511d97d980608.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2236
- C:\Users\Admin\AppData\Local\Temp\bfe4f0d29282ed16c45511d97d980608.exe
  C:\Users\Admin\AppData\Local\Temp\bfe4f0d29282ed16c45511d97d980608.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:2296

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\bfe4f0d29282ed16c45511d97d980608.exe

Filesize
128KB

MD5
b6df532927d3d28a17c8fa7131d09a8e

SHA1
60b541c294fc9cefba67a7306a44e8366c2df0fa

SHA256
c93348aa84f797820719dd5df902ea33f7cc7cb845c39f3b7b680d2288cc5952

SHA512
aaa2f129a76dbbb31a0dbcb76482274297e30624910aecaf56b4793b620d7d572963b4b62f42e73e7fa115f9dc3e696174a6015d7a3e2e6fba01fb981ce1d424

Download Submit
\Users\Admin\AppData\Local\Temp\bfe4f0d29282ed16c45511d97d980608.exe

Filesize
262KB

MD5
1d81c691b6db12ea239e745ae4c6e895

SHA1
e7b94ca1164a2c54fc4c0ce452eebcd9d9e1454f

SHA256
243a0570dbd4aaefa94e43c9c910204a8d5763ede0be1a1a24444105cae20476

SHA512
3e95080f74e145250ed812ba1801741956b3a28d943c680cc0c91e8ef92b433e31e94500dede2b4d741b33a814c029b89a44282baa71b0b6a2f6448fa05a01a3

Download Submit
memory/2236-15-0x00000000038B0000-0x0000000003D9F000-memory.dmp

Filesize
4.9MB

Download
memory/2236-2-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/2236-13-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/2236-1-0x00000000002B0000-0x00000000003E3000-memory.dmp

Filesize
1.2MB

Download
memory/2236-0-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/2236-31-0x00000000038B0000-0x0000000003D9F000-memory.dmp

Filesize
4.9MB

Download
memory/2296-17-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/2296-19-0x00000000018F0000-0x0000000001A23000-memory.dmp

Filesize
1.2MB

Download
memory/2296-16-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/2296-24-0x0000000003570000-0x000000000379A000-memory.dmp

Filesize
2.2MB

Download
memory/2296-23-0x0000000000400000-0x000000000061D000-memory.dmp

Filesize
2.1MB

Download
memory/2296-32-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download