cde3ff060b68c3183026a9e34d5b46eca793a9da925cb636fa2bd56157e0de24

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
14/03/2024, 07:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c7fdfa8910cadbda5374bf06fbb50651.exe
Size

11.7MB
MD5

c7fdfa8910cadbda5374bf06fbb50651
SHA1

ddb1cc0f8de3cde0aea48d24d13e44eae0c777bf
SHA256

cde3ff060b68c3183026a9e34d5b46eca793a9da925cb636fa2bd56157e0de24
SHA512

ad08da7937636a89007248feed55bbf759bb10150dabb7a412c2487e81477a564f5427cf8d015f30a3525f682c1cdf70c3e88791f8df3615ad7fb84510c9e717
SSDEEP

196608:OKqlh8/WCOu7xLCWCQY4D5PjKWCOu7xLCWC:OBl0UuVLChM5LKUuVLC

Score

7^/10

upx

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1964	c7fdfa8910cadbda5374bf06fbb50651.exe

Executes dropped EXE 1 IoCs

pid	Process
1964	c7fdfa8910cadbda5374bf06fbb50651.exe

Loads dropped DLL 1 IoCs

pid	Process
2360	c7fdfa8910cadbda5374bf06fbb50651.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2360-0-0x0000000000400000-0x00000000008EF000-memory.dmp	upx
behavioral1/files/0x0009000000014120-10.dat	upx
behavioral1/memory/2360-16-0x0000000004B20000-0x000000000500F000-memory.dmp	upx

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2360	c7fdfa8910cadbda5374bf06fbb50651.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2360	c7fdfa8910cadbda5374bf06fbb50651.exe
1964	c7fdfa8910cadbda5374bf06fbb50651.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2360 wrote to memory of 1964	2360	c7fdfa8910cadbda5374bf06fbb50651.exe	28
PID 2360 wrote to memory of 1964	2360	c7fdfa8910cadbda5374bf06fbb50651.exe	28
PID 2360 wrote to memory of 1964	2360	c7fdfa8910cadbda5374bf06fbb50651.exe	28
PID 2360 wrote to memory of 1964	2360	c7fdfa8910cadbda5374bf06fbb50651.exe	28

C:\Users\Admin\AppData\Local\Temp\c7fdfa8910cadbda5374bf06fbb50651.exe
"C:\Users\Admin\AppData\Local\Temp\c7fdfa8910cadbda5374bf06fbb50651.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2360
- C:\Users\Admin\AppData\Local\Temp\c7fdfa8910cadbda5374bf06fbb50651.exe
  C:\Users\Admin\AppData\Local\Temp\c7fdfa8910cadbda5374bf06fbb50651.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:1964

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\c7fdfa8910cadbda5374bf06fbb50651.exe

Filesize
11.7MB

MD5
af4508f16c3f8d9271a96a43299f8194

SHA1
cca7a913dc3a0c786d6d6decab9f0590ee07d6e2

SHA256
4b95228f9e5de3d8407f0273de1fb32c991dab4064b65163ac57e1b127766e57

SHA512
9ed769deefff13745cac1e16072c3ca6c77fde914faf95f2f14642885245eb9b9890bd7b22dc0235ec4cc69963bab5659271ff98bd866ec8fbdc2abb0712f019

Download Submit
memory/1964-18-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/1964-15-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/1964-20-0x0000000001B20000-0x0000000001C53000-memory.dmp

Filesize
1.2MB

Download
memory/1964-23-0x0000000000400000-0x000000000061D000-memory.dmp

Filesize
2.1MB

Download
memory/1964-24-0x00000000035A0000-0x00000000037CA000-memory.dmp

Filesize
2.2MB

Download
memory/1964-32-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/2360-2-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/2360-1-0x0000000001B20000-0x0000000001C53000-memory.dmp

Filesize
1.2MB

Download
memory/2360-16-0x0000000004B20000-0x000000000500F000-memory.dmp

Filesize
4.9MB

Download
memory/2360-0-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/2360-14-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/2360-31-0x0000000004B20000-0x000000000500F000-memory.dmp

Filesize
4.9MB

Download