f8c024fab0cc15e7a94d5caf4cf4f09acda9a8c1ee646e5c720b3d2f3c0a2ed8

Analysis

max time kernel
119s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
14/03/2024, 09:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c84906a84e9aa6e7a6c8bbf3e90057f0.exe
Size

2.7MB
MD5

c84906a84e9aa6e7a6c8bbf3e90057f0
SHA1

8b65ac6834b2c2873ae7082c0489a07953d77ab7
SHA256

f8c024fab0cc15e7a94d5caf4cf4f09acda9a8c1ee646e5c720b3d2f3c0a2ed8
SHA512

9aacae8eb9e63ff48986cbe94bec81c49fc8449e92db590b58f0faf1346f67cf9399b162d82f321caadfb0b0a9b6902485cb9a4286acd31562346de290579aad
SSDEEP

49152:693WxQmJ19Pl3n3cIhv6ov5x0SYbLq0R93qO3pYdArFXgt7+4CTDammv7uBQQT3c:6UP3r3n3cIhv5v5wPvH3xQAJgENKThzZ

Score

7^/10

upx

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2744	c84906a84e9aa6e7a6c8bbf3e90057f0.exe

Executes dropped EXE 1 IoCs

pid	Process
2744	c84906a84e9aa6e7a6c8bbf3e90057f0.exe

Loads dropped DLL 1 IoCs

pid	Process
2928	c84906a84e9aa6e7a6c8bbf3e90057f0.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2928-0-0x0000000000400000-0x00000000008E7000-memory.dmp	upx
behavioral1/files/0x000b00000001224f-10.dat	upx

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2928	c84906a84e9aa6e7a6c8bbf3e90057f0.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2928	c84906a84e9aa6e7a6c8bbf3e90057f0.exe
2744	c84906a84e9aa6e7a6c8bbf3e90057f0.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2928 wrote to memory of 2744	2928	c84906a84e9aa6e7a6c8bbf3e90057f0.exe	28
PID 2928 wrote to memory of 2744	2928	c84906a84e9aa6e7a6c8bbf3e90057f0.exe	28
PID 2928 wrote to memory of 2744	2928	c84906a84e9aa6e7a6c8bbf3e90057f0.exe	28
PID 2928 wrote to memory of 2744	2928	c84906a84e9aa6e7a6c8bbf3e90057f0.exe	28

C:\Users\Admin\AppData\Local\Temp\c84906a84e9aa6e7a6c8bbf3e90057f0.exe
"C:\Users\Admin\AppData\Local\Temp\c84906a84e9aa6e7a6c8bbf3e90057f0.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2928
- C:\Users\Admin\AppData\Local\Temp\c84906a84e9aa6e7a6c8bbf3e90057f0.exe
  C:\Users\Admin\AppData\Local\Temp\c84906a84e9aa6e7a6c8bbf3e90057f0.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:2744

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\c84906a84e9aa6e7a6c8bbf3e90057f0.exe

Filesize
2.7MB

MD5
126de6ed8d34d8ff9a79a559e5d10d0a

SHA1
f7cf4f92e6f7dc37b8df8ad8a4fc7936c15a16c1

SHA256
afdb8bb7d2f1a23a88f9392bc3f4d668be05b50e7ff2a24380d02ba625b83212

SHA512
0a17517534a147e5264723232a113b84e189855b9e06eecd98e9768ef90f414c04a8e09b2c52fe4e9518add55264b43fb06f087e53d2b8293e88d6fef47b7e4a

Download Submit
memory/2744-15-0x0000000000400000-0x0000000000622000-memory.dmp

Filesize
2.1MB

Download
memory/2744-19-0x0000000000400000-0x00000000008E7000-memory.dmp

Filesize
4.9MB

Download
memory/2744-21-0x00000000018F0000-0x0000000001A21000-memory.dmp

Filesize
1.2MB

Download
memory/2744-23-0x0000000000400000-0x0000000000616000-memory.dmp

Filesize
2.1MB

Download
memory/2744-24-0x0000000003550000-0x0000000003772000-memory.dmp

Filesize
2.1MB

Download
memory/2744-32-0x0000000000400000-0x00000000008E7000-memory.dmp

Filesize
4.9MB

Download
memory/2928-2-0x0000000000290000-0x00000000003C1000-memory.dmp

Filesize
1.2MB

Download
memory/2928-1-0x0000000000400000-0x0000000000622000-memory.dmp

Filesize
2.1MB

Download
memory/2928-13-0x0000000000400000-0x0000000000622000-memory.dmp

Filesize
2.1MB

Download
memory/2928-16-0x0000000003A00000-0x0000000003EE7000-memory.dmp

Filesize
4.9MB

Download
memory/2928-0-0x0000000000400000-0x00000000008E7000-memory.dmp

Filesize
4.9MB

Download
memory/2928-31-0x0000000003A00000-0x0000000003EE7000-memory.dmp

Filesize
4.9MB

Download