Analysis

  • max time kernel
    143s
  • max time network
    144s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    11-03-2024 18:37

General

  • Target

    c151d21c8966c78dc9711f79f7dd51dd.exe

  • Size

    10.2MB

  • MD5

    c151d21c8966c78dc9711f79f7dd51dd

  • SHA1

    747fb219c46ebeb92eba19978176fae1ff818c60

  • SHA256

    8792bb633885e0e9c5bc69ec1ea781e69e62a3da090954f008b36b0f609c2c79

  • SHA512

    4ea64ba7274402ff34567849c835b8a975c507385648fb7d5d6c00d5d0ceeb247ff1a26d7c7c760bbdd72802a9ca6f40295333cbc33f574f01343fae45853124

  • SSDEEP

    98304:N8ZD+vGY18MCb30g2yOEjjs9/g3rC0Pnn4VCB30g2yOEjjs9/g3:Kp+uaawZUju/b0Pn4VCqZUju/

Score
7/10
upx

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Modifies system certificate store 2 TTPs 4 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c151d21c8966c78dc9711f79f7dd51dd.exe
    "C:\Users\Admin\AppData\Local\Temp\c151d21c8966c78dc9711f79f7dd51dd.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: RenamesItself
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:2920
    • C:\Users\Admin\AppData\Local\Temp\c151d21c8966c78dc9711f79f7dd51dd.exe
      C:\Users\Admin\AppData\Local\Temp\c151d21c8966c78dc9711f79f7dd51dd.exe
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Modifies system certificate store
      • Suspicious use of UnmapMainImage
      PID:2856

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\c151d21c8966c78dc9711f79f7dd51dd.exe

    Filesize

    148KB

    MD5

    f25c90ea27bc8935c178c81abe8d892c

    SHA1

    2d95060976f60b8953f141f846deda5827cc7f0c

    SHA256

    d0a379861111c2ed947ed98325db8b271f4ec02f71f7b7de5437294493eb2e79

    SHA512

    0f8a022a25235bd662f2e0fa558db2f7749dbeb2f2b01b8b0e1e989b7e91b5a3b4d455ad8e391daef674d9e3ead40f0d6060c4dd14f1bce50c2345f00cb95fa2

  • \Users\Admin\AppData\Local\Temp\c151d21c8966c78dc9711f79f7dd51dd.exe

    Filesize

    661KB

    MD5

    e37366f28f6c39781fbefbab686799bb

    SHA1

    8ce693271f97c1f687d8e4208f32ba7c90ef07c6

    SHA256

    9d79f003f2e08c7ac31e99cc3f89a499edbaeefcbcfaa488623d01ae7faab3ed

    SHA512

    690e27608d38eb5c51d746a5d6c15c36aeb051abddf840ab44580cc105601f7c4b54956b3abe17df01c14fc4ae0b54fb0d9cf44152048c093a88071339e5ced9

  • memory/2856-19-0x0000000000400000-0x0000000000D9E000-memory.dmp

    Filesize

    9.6MB

  • memory/2856-21-0x0000000001FA0000-0x00000000021FA000-memory.dmp

    Filesize

    2.4MB

  • memory/2856-44-0x0000000000400000-0x0000000000D9E000-memory.dmp

    Filesize

    9.6MB

  • memory/2920-0-0x0000000000400000-0x0000000000D9E000-memory.dmp

    Filesize

    9.6MB

  • memory/2920-1-0x0000000000400000-0x0000000000605000-memory.dmp

    Filesize

    2.0MB

  • memory/2920-2-0x00000000021C0000-0x000000000241A000-memory.dmp

    Filesize

    2.4MB

  • memory/2920-17-0x0000000004CC0000-0x000000000565E000-memory.dmp

    Filesize

    9.6MB

  • memory/2920-15-0x0000000000400000-0x0000000000605000-memory.dmp

    Filesize

    2.0MB

  • memory/2920-43-0x0000000004CC0000-0x000000000565E000-memory.dmp

    Filesize

    9.6MB