e1c622bca17051440ca951ebdb0ee41e91f80de56ac97295b2dc5ed12d6e91bf

Analysis

max time kernel
118s
max time network
129s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
16/03/2024, 05:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cd2f6136abf2ba057317c551ee919eb8.exe
Size

5.8MB
MD5

cd2f6136abf2ba057317c551ee919eb8
SHA1

7a568cdaec3454cce146433236656e860752dcaf
SHA256

e1c622bca17051440ca951ebdb0ee41e91f80de56ac97295b2dc5ed12d6e91bf
SHA512

cb1d2ec45b4dc9b058c5a1fad4e0926026901fe933fe8712915e313ac17261179b137713c626e71ff0d51fe5b837cb0dde0fc8417a30f1e705444e938c0aa3b8
SSDEEP

98304:m15lcSS6YNBkPQHau42c1joCjMPkNwk6alDAqD7z3uboHau42c1joCjMPkNwk6:mHqDVNG6auq1jI86FA7y2auq1jI86

Score

7^/10

upx

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3060	cd2f6136abf2ba057317c551ee919eb8.exe

Executes dropped EXE 1 IoCs

pid	Process
3060	cd2f6136abf2ba057317c551ee919eb8.exe

Loads dropped DLL 1 IoCs

pid	Process
1184	cd2f6136abf2ba057317c551ee919eb8.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1184-0-0x0000000000400000-0x00000000008EF000-memory.dmp	upx
behavioral1/files/0x0009000000012246-10.dat	upx
behavioral1/files/0x0009000000012246-13.dat	upx

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1184	cd2f6136abf2ba057317c551ee919eb8.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
1184	cd2f6136abf2ba057317c551ee919eb8.exe
3060	cd2f6136abf2ba057317c551ee919eb8.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1184 wrote to memory of 3060	1184	cd2f6136abf2ba057317c551ee919eb8.exe	28
PID 1184 wrote to memory of 3060	1184	cd2f6136abf2ba057317c551ee919eb8.exe	28
PID 1184 wrote to memory of 3060	1184	cd2f6136abf2ba057317c551ee919eb8.exe	28
PID 1184 wrote to memory of 3060	1184	cd2f6136abf2ba057317c551ee919eb8.exe	28

C:\Users\Admin\AppData\Local\Temp\cd2f6136abf2ba057317c551ee919eb8.exe
"C:\Users\Admin\AppData\Local\Temp\cd2f6136abf2ba057317c551ee919eb8.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1184
- C:\Users\Admin\AppData\Local\Temp\cd2f6136abf2ba057317c551ee919eb8.exe
  C:\Users\Admin\AppData\Local\Temp\cd2f6136abf2ba057317c551ee919eb8.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:3060

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\cd2f6136abf2ba057317c551ee919eb8.exe

Filesize
704KB

MD5
4c9b18791e8bd7d15ca2a4105072c10c

SHA1
2e4c458bc233a4b217644c5037be8b00b9e1f9e0

SHA256
7cc10e1d1f097aeec95548a9412d69d96928cff41d440e4aa3c406cbd821a380

SHA512
4a77c01883312bf72174c14c13ef5c4bb8efb1993831de8594b2532764e99adfe442cea43551a4dcc485b4f73112984262d9a3635dd367a8db0823affcc9ae49

Download Submit
\Users\Admin\AppData\Local\Temp\cd2f6136abf2ba057317c551ee919eb8.exe

Filesize
768KB

MD5
44bbbb9e7657762a836ecacce0ec4baf

SHA1
962a753d73431077f8e1e04bcdbf9afdf7b8793c

SHA256
68badbe602999a42106c067d8ddc20fafecc5f9f3b839c3866c9984904f5c184

SHA512
48f477b31b8e3ca551d85e3c4ccbb454ee1aeb6b842e7a0a51b0d2fe203b92c85cacaf3597996e4686321f337c6178c609f39d27a7dcac88396bbcddf2814719

Download Submit
memory/1184-15-0x0000000003DF0000-0x00000000042DF000-memory.dmp

Filesize
4.9MB

Download
memory/1184-2-0x0000000000130000-0x0000000000263000-memory.dmp

Filesize
1.2MB

Download
memory/1184-1-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/1184-14-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/1184-0-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/1184-31-0x0000000003DF0000-0x00000000042DF000-memory.dmp

Filesize
4.9MB

Download
memory/3060-16-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/3060-18-0x00000000002A0000-0x00000000003D3000-memory.dmp

Filesize
1.2MB

Download
memory/3060-17-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/3060-23-0x0000000000400000-0x000000000061D000-memory.dmp

Filesize
2.1MB

Download
memory/3060-24-0x00000000036C0000-0x00000000038EA000-memory.dmp

Filesize
2.2MB

Download
memory/3060-32-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download