6c20abe4b3c34d04aff6fef43685e39dfc5e4c1b2dc4ba9a95cd6bdb75e1dac5

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
13/03/2024, 10:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

c5aa23f5fcaab643d3ccb21c2a778af6.exe
Size

5.3MB
MD5

c5aa23f5fcaab643d3ccb21c2a778af6
SHA1

c600e08dcf29d0f3b620da284d17e9295f7b5397
SHA256

6c20abe4b3c34d04aff6fef43685e39dfc5e4c1b2dc4ba9a95cd6bdb75e1dac5
SHA512

077c201162893dcdfaddbca229d12ecac553baa9bcd84c71255a1f0f1a79dfc025a074e1fbdabbb26f100b81b59b9b51930cadfca8f520785689840cca591020
SSDEEP

98304:Wi5H/4S0Beb1T1aq6Erd84ZgXTdPBeb1T1aq:WOf4S3b7aUdzOTSb7a

Score

7^/10

upx

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2956	c5aa23f5fcaab643d3ccb21c2a778af6.exe

Executes dropped EXE 1 IoCs

pid	Process
2956	c5aa23f5fcaab643d3ccb21c2a778af6.exe

Loads dropped DLL 1 IoCs

pid	Process
2924	c5aa23f5fcaab643d3ccb21c2a778af6.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2924-0-0x0000000000400000-0x000000000086A000-memory.dmp	upx
behavioral1/files/0x000b000000012251-11.dat	upx
behavioral1/files/0x000b000000012251-15.dat	upx

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2924	c5aa23f5fcaab643d3ccb21c2a778af6.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2924	c5aa23f5fcaab643d3ccb21c2a778af6.exe
2956	c5aa23f5fcaab643d3ccb21c2a778af6.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2924 wrote to memory of 2956	2924	c5aa23f5fcaab643d3ccb21c2a778af6.exe	28
PID 2924 wrote to memory of 2956	2924	c5aa23f5fcaab643d3ccb21c2a778af6.exe	28
PID 2924 wrote to memory of 2956	2924	c5aa23f5fcaab643d3ccb21c2a778af6.exe	28
PID 2924 wrote to memory of 2956	2924	c5aa23f5fcaab643d3ccb21c2a778af6.exe	28

C:\Users\Admin\AppData\Local\Temp\c5aa23f5fcaab643d3ccb21c2a778af6.exe
"C:\Users\Admin\AppData\Local\Temp\c5aa23f5fcaab643d3ccb21c2a778af6.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2924
- C:\Users\Admin\AppData\Local\Temp\c5aa23f5fcaab643d3ccb21c2a778af6.exe
  C:\Users\Admin\AppData\Local\Temp\c5aa23f5fcaab643d3ccb21c2a778af6.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:2956

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\c5aa23f5fcaab643d3ccb21c2a778af6.exe

Filesize
1.7MB

MD5
a40cb1dbb7bc44ef5ec573674a17dc89

SHA1
a74b265077864ccbea1d2a255a48cfdbdf7dce1a

SHA256
b76129c3db336ed507af669a11db465a70776d3258dc9df3c882b99dc298490f

SHA512
e0aaae524df3279d2d25fc1436eadc21d84d49b4fc0eca7bcf0f5e9c5d0a51686a337ea366f034677047c4a9285311f89c9003f7bd737450e77a56addf717d48

Download Submit
\Users\Admin\AppData\Local\Temp\c5aa23f5fcaab643d3ccb21c2a778af6.exe

Filesize
2.9MB

MD5
021b27e1670618fd455815bdd993867b

SHA1
40a2bc689b8b5f41f19d36e88729972f719260df

SHA256
cf3b9cb053d24696d6ce15408661707b02f0978095c32d7d87784cbbe1f5708f

SHA512
063cc7b51384e2b97539fe5221653128357facdbf5dc617fd23f0a48aef1de74f4dac33e712ad0c2e2c0025fb8b21db64953b64aa29ac3929e7f034132887828

Download Submit
memory/2924-0-0x0000000000400000-0x000000000086A000-memory.dmp

Filesize
4.4MB

Download
memory/2924-1-0x0000000000400000-0x00000000005F2000-memory.dmp

Filesize
1.9MB

Download
memory/2924-2-0x0000000000240000-0x0000000000352000-memory.dmp

Filesize
1.1MB

Download
memory/2924-17-0x0000000000400000-0x00000000005F2000-memory.dmp

Filesize
1.9MB

Download
memory/2924-16-0x0000000003CD0000-0x000000000413A000-memory.dmp

Filesize
4.4MB

Download
memory/2924-27-0x0000000003CD0000-0x000000000413A000-memory.dmp

Filesize
4.4MB

Download
memory/2956-18-0x0000000000400000-0x00000000005F2000-memory.dmp

Filesize
1.9MB

Download
memory/2956-19-0x0000000000400000-0x000000000086A000-memory.dmp

Filesize
4.4MB

Download
memory/2956-21-0x0000000000290000-0x00000000003A2000-memory.dmp

Filesize
1.1MB

Download
memory/2956-28-0x0000000000400000-0x000000000086A000-memory.dmp

Filesize
4.4MB

Download