3526c74a22a6a7ff285bddc4a055d22e443bd2d9ceb47aa7bc20240256084787

Analysis

max time kernel
1563s
max time network
1564s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
26-03-2024 13:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b878926219059096382653b807efb9476435cc6d3401667c502d2c7bb2f6d7be.exe
Size

161KB
MD5

ba6e3d454c86502e413c299303686cab
SHA1

8ffa2398965a1ad4503566e07e0a8cea4cd168e4
SHA256

b878926219059096382653b807efb9476435cc6d3401667c502d2c7bb2f6d7be
SHA512

b0035f23c520f8f84b88498fcb3945e4b7edf1f7713de9837ed9a4c02443d0bbec3200dbece3671d866803bf7ac07a4d7116afc89b619767dea6e71e91c4a1df
SSDEEP

3072:a1mDHCjYBNCERkjlK7Xa3mUrvwF+OPgAwVbAtOP+uLXD8Ku7IhhV6u:FOjkCE/a3mmvwFavV/L4Kq4e

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral23/memory/2368-0-0x0000000000400000-0x0000000000415000-memory.dmp	upx
behavioral23/memory/2368-6-0x0000000000400000-0x0000000000415000-memory.dmp	upx
behavioral23/memory/2192-10-0x0000000000400000-0x0000000000427000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

Processes:

b878926219059096382653b807efb9476435cc6d3401667c502d2c7bb2f6d7be.exe

description	pid	process	target process
PID 2368 set thread context of 2192	2368	b878926219059096382653b807efb9476435cc6d3401667c502d2c7bb2f6d7be.exe	b878926219059096382653b807efb9476435cc6d3401667c502d2c7bb2f6d7be.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

b878926219059096382653b807efb9476435cc6d3401667c502d2c7bb2f6d7be.exe

pid process

2368 b878926219059096382653b807efb9476435cc6d3401667c502d2c7bb2f6d7be.exe

pid	process
2368	b878926219059096382653b807efb9476435cc6d3401667c502d2c7bb2f6d7be.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

b878926219059096382653b807efb9476435cc6d3401667c502d2c7bb2f6d7be.exe

description	pid	process	target process
PID 2368 wrote to memory of 2192	2368	b878926219059096382653b807efb9476435cc6d3401667c502d2c7bb2f6d7be.exe	b878926219059096382653b807efb9476435cc6d3401667c502d2c7bb2f6d7be.exe
PID 2368 wrote to memory of 2192	2368	b878926219059096382653b807efb9476435cc6d3401667c502d2c7bb2f6d7be.exe	b878926219059096382653b807efb9476435cc6d3401667c502d2c7bb2f6d7be.exe
PID 2368 wrote to memory of 2192	2368	b878926219059096382653b807efb9476435cc6d3401667c502d2c7bb2f6d7be.exe	b878926219059096382653b807efb9476435cc6d3401667c502d2c7bb2f6d7be.exe
PID 2368 wrote to memory of 2192	2368	b878926219059096382653b807efb9476435cc6d3401667c502d2c7bb2f6d7be.exe	b878926219059096382653b807efb9476435cc6d3401667c502d2c7bb2f6d7be.exe
PID 2368 wrote to memory of 2192	2368	b878926219059096382653b807efb9476435cc6d3401667c502d2c7bb2f6d7be.exe	b878926219059096382653b807efb9476435cc6d3401667c502d2c7bb2f6d7be.exe
PID 2368 wrote to memory of 2192	2368	b878926219059096382653b807efb9476435cc6d3401667c502d2c7bb2f6d7be.exe	b878926219059096382653b807efb9476435cc6d3401667c502d2c7bb2f6d7be.exe
PID 2368 wrote to memory of 2192	2368	b878926219059096382653b807efb9476435cc6d3401667c502d2c7bb2f6d7be.exe	b878926219059096382653b807efb9476435cc6d3401667c502d2c7bb2f6d7be.exe
PID 2368 wrote to memory of 2192	2368	b878926219059096382653b807efb9476435cc6d3401667c502d2c7bb2f6d7be.exe	b878926219059096382653b807efb9476435cc6d3401667c502d2c7bb2f6d7be.exe
PID 2368 wrote to memory of 2192	2368	b878926219059096382653b807efb9476435cc6d3401667c502d2c7bb2f6d7be.exe	b878926219059096382653b807efb9476435cc6d3401667c502d2c7bb2f6d7be.exe

C:\Users\Admin\AppData\Local\Temp\b878926219059096382653b807efb9476435cc6d3401667c502d2c7bb2f6d7be.exe
"C:\Users\Admin\AppData\Local\Temp\b878926219059096382653b807efb9476435cc6d3401667c502d2c7bb2f6d7be.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2368

C:\Users\Admin\AppData\Local\Temp\b878926219059096382653b807efb9476435cc6d3401667c502d2c7bb2f6d7be.exe
C:\Users\Admin\AppData\Local\Temp\b878926219059096382653b807efb9476435cc6d3401667c502d2c7bb2f6d7be.exe
2⤵
PID:2192

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2192-3-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2192-7-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2192-8-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2192-10-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2368-0-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/2368-6-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads