92d63f1a9328ccebad182f9f9ebf3416f66e7301be047726170ccf6b1ff6a72c

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
14-03-2024 06:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c7e8d53a7ba2793e267ad7be7fc1e165.exe
Size

5.3MB
MD5

c7e8d53a7ba2793e267ad7be7fc1e165
SHA1

4728297583661f9390215bd3e7009a44a9b4deb8
SHA256

92d63f1a9328ccebad182f9f9ebf3416f66e7301be047726170ccf6b1ff6a72c
SHA512

81a9668ada3813bf8d5088ee00d07b4ca7112e3fe5a96081bc63c9f412b803b2df75524235e0a406966440b67fe79308c1770b5c510b736920f54a0de90972ae
SSDEEP

98304:9oeUUqluEl96uiCHktBcwQDM2YIDULHsf4BdfskbHktBcwQDM2YIDULHt:9oe7qMEl5schDHIS4BnbschDHIN

Score

7^/10

upx

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2652	c7e8d53a7ba2793e267ad7be7fc1e165.exe

Executes dropped EXE 1 IoCs

pid	Process
2652	c7e8d53a7ba2793e267ad7be7fc1e165.exe

Loads dropped DLL 1 IoCs

pid	Process
1968	c7e8d53a7ba2793e267ad7be7fc1e165.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1968-0-0x0000000000400000-0x00000000008E7000-memory.dmp	upx
behavioral1/files/0x000b00000001332e-10.dat	upx

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1968	c7e8d53a7ba2793e267ad7be7fc1e165.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
1968	c7e8d53a7ba2793e267ad7be7fc1e165.exe
2652	c7e8d53a7ba2793e267ad7be7fc1e165.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1968 wrote to memory of 2652	1968	c7e8d53a7ba2793e267ad7be7fc1e165.exe	28
PID 1968 wrote to memory of 2652	1968	c7e8d53a7ba2793e267ad7be7fc1e165.exe	28
PID 1968 wrote to memory of 2652	1968	c7e8d53a7ba2793e267ad7be7fc1e165.exe	28
PID 1968 wrote to memory of 2652	1968	c7e8d53a7ba2793e267ad7be7fc1e165.exe	28

C:\Users\Admin\AppData\Local\Temp\c7e8d53a7ba2793e267ad7be7fc1e165.exe
"C:\Users\Admin\AppData\Local\Temp\c7e8d53a7ba2793e267ad7be7fc1e165.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1968
- C:\Users\Admin\AppData\Local\Temp\c7e8d53a7ba2793e267ad7be7fc1e165.exe
  C:\Users\Admin\AppData\Local\Temp\c7e8d53a7ba2793e267ad7be7fc1e165.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:2652

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\c7e8d53a7ba2793e267ad7be7fc1e165.exe

Filesize
5.3MB

MD5
56547ecb0b83904131d061f2c2771a2a

SHA1
3e544e6d0ce25c49f96184183cd8f1be49311609

SHA256
3614e67d501f97b852e1aeae0d84fe94f30c894177bcd53b1a921cf65d23d7ad

SHA512
197d5021baa545632e2147c8ffd229d625e91bbb5cf2c051836f52c79ec4997d8a64cfa3dbf79ec044b7763974375eb33bc496db07b0146ecb3da54b6bc6fc5a

Download Submit
memory/1968-13-0x0000000000400000-0x0000000000622000-memory.dmp

Filesize
2.1MB

Download
memory/1968-1-0x0000000000400000-0x0000000000622000-memory.dmp

Filesize
2.1MB

Download
memory/1968-2-0x0000000001B10000-0x0000000001C41000-memory.dmp

Filesize
1.2MB

Download
memory/1968-16-0x0000000003E30000-0x0000000004317000-memory.dmp

Filesize
4.9MB

Download
memory/1968-0-0x0000000000400000-0x00000000008E7000-memory.dmp

Filesize
4.9MB

Download
memory/1968-31-0x0000000003E30000-0x0000000004317000-memory.dmp

Filesize
4.9MB

Download
memory/2652-15-0x0000000000400000-0x0000000000622000-memory.dmp

Filesize
2.1MB

Download
memory/2652-18-0x0000000000400000-0x00000000008E7000-memory.dmp

Filesize
4.9MB

Download
memory/2652-20-0x0000000000130000-0x0000000000261000-memory.dmp

Filesize
1.2MB

Download
memory/2652-23-0x0000000000400000-0x0000000000616000-memory.dmp

Filesize
2.1MB

Download
memory/2652-25-0x00000000033D0000-0x00000000035F2000-memory.dmp

Filesize
2.1MB

Download
memory/2652-32-0x0000000000400000-0x00000000008E7000-memory.dmp

Filesize
4.9MB

Download