c063b5b566e5744ad7cb29a4416db801b362760243658d971b8633c8c9d7071f

Analysis

max time kernel
117s
max time network
127s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
12/03/2024, 13:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c37497683e028042debd07cc25c2ed57.exe
Size

2.9MB
MD5

c37497683e028042debd07cc25c2ed57
SHA1

15adf4330eb95974b010096660359d011041684b
SHA256

c063b5b566e5744ad7cb29a4416db801b362760243658d971b8633c8c9d7071f
SHA512

06c6136f59dcbe46f07d0b38f7783335a6941e1ec8c5f839a42ed959e7c69b98d28d9f3dd71ffbe95f8e1faa535193cee10173267bcbb12be60187d158ba3fea
SSDEEP

49152:9WZjL4X720ewNj5DkaUlGRShg4XP4M338dB2IBlGuuDVUsdxxjeQZwxPYRKs:Wj620wahRShZXgg3gnl/IVUs1jePs

Score

7^/10

upx

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2604	c37497683e028042debd07cc25c2ed57.exe

Executes dropped EXE 1 IoCs

pid	Process
2604	c37497683e028042debd07cc25c2ed57.exe

Loads dropped DLL 1 IoCs

pid	Process
2196	c37497683e028042debd07cc25c2ed57.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2196-0-0x0000000000400000-0x00000000008EF000-memory.dmp	upx
behavioral1/files/0x0009000000012226-12.dat	upx
behavioral1/files/0x0009000000012226-15.dat	upx
behavioral1/files/0x0009000000012226-10.dat	upx
behavioral1/memory/2604-16-0x0000000000400000-0x00000000008EF000-memory.dmp	upx

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2196	c37497683e028042debd07cc25c2ed57.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2196	c37497683e028042debd07cc25c2ed57.exe
2604	c37497683e028042debd07cc25c2ed57.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2196 wrote to memory of 2604	2196	c37497683e028042debd07cc25c2ed57.exe	28
PID 2196 wrote to memory of 2604	2196	c37497683e028042debd07cc25c2ed57.exe	28
PID 2196 wrote to memory of 2604	2196	c37497683e028042debd07cc25c2ed57.exe	28
PID 2196 wrote to memory of 2604	2196	c37497683e028042debd07cc25c2ed57.exe	28

C:\Users\Admin\AppData\Local\Temp\c37497683e028042debd07cc25c2ed57.exe
"C:\Users\Admin\AppData\Local\Temp\c37497683e028042debd07cc25c2ed57.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2196
- C:\Users\Admin\AppData\Local\Temp\c37497683e028042debd07cc25c2ed57.exe
  C:\Users\Admin\AppData\Local\Temp\c37497683e028042debd07cc25c2ed57.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:2604

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\c37497683e028042debd07cc25c2ed57.exe

Filesize
896KB

MD5
7afb1b3ba75b133ffef2399b90e3fe13

SHA1
3ad002f1a39e863c5c77258dc05fb9695c323b93

SHA256
3575d3e805aa979eaf27d3147fc6868bde2415eb1974f3aa63c2e950ab1d8e5d

SHA512
4271628a09bcf97259628e36a8b371afb4664b7f59b7852e31f36e961f94748478df192e4cb037a31dcac4c0bfdce48b8b01d9fccf85bd5c2326e3a27634a933

Download Submit
C:\Users\Admin\AppData\Local\Temp\c37497683e028042debd07cc25c2ed57.exe

Filesize
2.9MB

MD5
fd36f41fb3d66e1fefea916bffb87bfa

SHA1
9db8b375dee70ee7283e6bfa5b32dff6f6477ced

SHA256
338fe52bc2268e48a4dc870883fe9d5ff75f761930743e4a437080064d1caa66

SHA512
4e38f259298c83e922e8ba5f48b9c032d16b5d07a7ec7066ce39440ccac81642108ea8e61a1b4aa7bd6d75e286fbe9b5f05c548bfa1109f208e110b97b8a61d8

Download Submit
\Users\Admin\AppData\Local\Temp\c37497683e028042debd07cc25c2ed57.exe

Filesize
2.5MB

MD5
15d0af75cec5def7d6344b79f3a10f1d

SHA1
14d13856bece188e1ba40e47e875ae913426d394

SHA256
3401d35e2c42868e58c9e33a8cc1e6524a7c488b37fe080716a4d8ba0bcb0eda

SHA512
5f2e8976905f36b11411f27aa3d64431f93bd37e9507e1190b8eb3b43c4a4e4c6c37d0e98ac847093b5c28c175b5c51a69253fc56e6f8d3fc386d758926c9155

Download Submit
memory/2196-1-0x0000000000280000-0x00000000003B3000-memory.dmp

Filesize
1.2MB

Download
memory/2196-2-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/2196-13-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/2196-0-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/2196-14-0x00000000038F0000-0x0000000003DDF000-memory.dmp

Filesize
4.9MB

Download
memory/2196-31-0x00000000038F0000-0x0000000003DDF000-memory.dmp

Filesize
4.9MB

Download
memory/2604-16-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/2604-17-0x0000000001B20000-0x0000000001C53000-memory.dmp

Filesize
1.2MB

Download
memory/2604-18-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/2604-25-0x0000000003410000-0x000000000363A000-memory.dmp

Filesize
2.2MB

Download
memory/2604-23-0x0000000000400000-0x000000000061D000-memory.dmp

Filesize
2.1MB

Download
memory/2604-32-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download