3533b975668ad6bc6d590325744d800bfdb72938262d01cd30642aedcbebbe4f

Analysis

max time kernel
119s
max time network
128s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
18-03-2024 12:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d3781a163d0410fef27b8f93d0424ed4.exe
Size

1.5MB
MD5

d3781a163d0410fef27b8f93d0424ed4
SHA1

ae5be963ede3d8bbc088b1983866f05bde3583eb
SHA256

3533b975668ad6bc6d590325744d800bfdb72938262d01cd30642aedcbebbe4f
SHA512

382ee2f7f3cc152133d1df21c22b2720565bde19866ed6a82e1c9c9397b0b175810016af77adcc37137f57995b7b3db94e43d3624ecdb51c264d2e900d4513e6
SSDEEP

24576:EKpdaHwN+9pqm7s58FHB8J1fxLZEB5zgElvWZuN3Io/n5fQf8mybETW:9d9Mzqm7s5AOJZxW5zDsuNFn5vxET

Score

7^/10

upx

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2588	d3781a163d0410fef27b8f93d0424ed4.exe

Executes dropped EXE 1 IoCs

pid	Process
2588	d3781a163d0410fef27b8f93d0424ed4.exe

Loads dropped DLL 1 IoCs

pid	Process
2488	d3781a163d0410fef27b8f93d0424ed4.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2488-0-0x0000000000400000-0x00000000008EF000-memory.dmp	upx
behavioral1/files/0x000a0000000141af-10.dat	upx
behavioral1/files/0x000a0000000141af-13.dat	upx
behavioral1/memory/2588-16-0x0000000000400000-0x00000000008EF000-memory.dmp	upx

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2488	d3781a163d0410fef27b8f93d0424ed4.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2488	d3781a163d0410fef27b8f93d0424ed4.exe
2588	d3781a163d0410fef27b8f93d0424ed4.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2488 wrote to memory of 2588	2488	d3781a163d0410fef27b8f93d0424ed4.exe	28
PID 2488 wrote to memory of 2588	2488	d3781a163d0410fef27b8f93d0424ed4.exe	28
PID 2488 wrote to memory of 2588	2488	d3781a163d0410fef27b8f93d0424ed4.exe	28
PID 2488 wrote to memory of 2588	2488	d3781a163d0410fef27b8f93d0424ed4.exe	28

C:\Users\Admin\AppData\Local\Temp\d3781a163d0410fef27b8f93d0424ed4.exe
"C:\Users\Admin\AppData\Local\Temp\d3781a163d0410fef27b8f93d0424ed4.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2488
- C:\Users\Admin\AppData\Local\Temp\d3781a163d0410fef27b8f93d0424ed4.exe
  C:\Users\Admin\AppData\Local\Temp\d3781a163d0410fef27b8f93d0424ed4.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:2588

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\d3781a163d0410fef27b8f93d0424ed4.exe

Filesize
1.5MB

MD5
be76c06352c16c1c988012acf82d378a

SHA1
6f1ae46fe0076f852ea4087d956a953134642e50

SHA256
7e6530c761b8d6bec6cde53381a752165f9f5e1c3b9ded57de335da5cd01b919

SHA512
880eac3f86cefe87cbf6fa7daa535b88639749a421db7f159be042c6c1c6824c0cda9fc6d373d9e9559037bc81fc28c7d79c0db7a2b1b8762e7fe12557a79c25

Download Submit
\Users\Admin\AppData\Local\Temp\d3781a163d0410fef27b8f93d0424ed4.exe

Filesize
128KB

MD5
4ee3115d19cc45d9d4ef10899323891f

SHA1
7ec4a3bf708d6f8867c03fdf939794f795fae271

SHA256
d4f56333c7bc8cc9b8a6c5980f1d3eeb39fdf1eb91bae2cbf0d7b1fb562df9d2

SHA512
fc9f21f60b06a45c9e8885c02ce6f9309d6bab42040ba511608c36917ef5c66bcc3d1fc46d46c1f342e7866cc6faabf3749b45d45a25ab2cac88c5966b3511e1

Download Submit
memory/2488-0-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/2488-1-0x00000000002B0000-0x00000000003E3000-memory.dmp

Filesize
1.2MB

Download
memory/2488-2-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/2488-14-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/2588-15-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/2588-16-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/2588-18-0x00000000018F0000-0x0000000001A23000-memory.dmp

Filesize
1.2MB

Download
memory/2588-22-0x0000000000400000-0x000000000061D000-memory.dmp

Filesize
2.1MB

Download
memory/2588-23-0x0000000003570000-0x000000000379A000-memory.dmp

Filesize
2.2MB

Download
memory/2588-30-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download