7b22e03bb1fd062ee34e9434a3a39e8e74e64c3ee4e57e673c62d2499f95b480

Analysis

max time kernel
121s
max time network
127s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
26-03-2024 17:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dfb275e89e3caef87ae62a488e45a7f7.exe
Size

2.7MB
MD5

dfb275e89e3caef87ae62a488e45a7f7
SHA1

39d9b7d5b1073abfe79575db426b088dbfca381e
SHA256

7b22e03bb1fd062ee34e9434a3a39e8e74e64c3ee4e57e673c62d2499f95b480
SHA512

af69c4437bf77c6872ad46a177844388661d7dcab1623eeee4661c7b3ccf758699a40310d6f86b419d6b5112aeebdbd21161c787867087ff50f2604153f2ef2d
SSDEEP

49152:Q3IhW6knftNEZ0f9DThN90fGCLcHcBesLLgNrGuO3UR:CIo6IfQiBTb90HLwKcUuMG

Score

7^/10

upx

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1996	dfb275e89e3caef87ae62a488e45a7f7.exe

Executes dropped EXE 1 IoCs

pid	Process
1996	dfb275e89e3caef87ae62a488e45a7f7.exe

Loads dropped DLL 1 IoCs

pid	Process
824	dfb275e89e3caef87ae62a488e45a7f7.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/824-0-0x0000000000400000-0x000000000086A000-memory.dmp	upx
behavioral1/files/0x000d000000012267-11.dat	upx
behavioral1/files/0x000d000000012267-13.dat	upx

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
824	dfb275e89e3caef87ae62a488e45a7f7.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
824	dfb275e89e3caef87ae62a488e45a7f7.exe
1996	dfb275e89e3caef87ae62a488e45a7f7.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 824 wrote to memory of 1996	824	dfb275e89e3caef87ae62a488e45a7f7.exe	28
PID 824 wrote to memory of 1996	824	dfb275e89e3caef87ae62a488e45a7f7.exe	28
PID 824 wrote to memory of 1996	824	dfb275e89e3caef87ae62a488e45a7f7.exe	28
PID 824 wrote to memory of 1996	824	dfb275e89e3caef87ae62a488e45a7f7.exe	28

C:\Users\Admin\AppData\Local\Temp\dfb275e89e3caef87ae62a488e45a7f7.exe
"C:\Users\Admin\AppData\Local\Temp\dfb275e89e3caef87ae62a488e45a7f7.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:824
- C:\Users\Admin\AppData\Local\Temp\dfb275e89e3caef87ae62a488e45a7f7.exe
  C:\Users\Admin\AppData\Local\Temp\dfb275e89e3caef87ae62a488e45a7f7.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:1996

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\dfb275e89e3caef87ae62a488e45a7f7.exe

Filesize
2.7MB

MD5
516a3a43df474a5e83169ac2a4e4876c

SHA1
b5ebda1c6a9f08604c88ab5cf1d4100ced68d271

SHA256
5d7f171822af14d852508033a31916b0ee003e7efb36620093d848b5ff8e5aa4

SHA512
8089f80ccd068e309c3fcb1233a46e8ebc39334df05d2802d2f4d642c5dc88fe038cad410c96d91d46b8533de8a8c98932e71be80dbce13459ff19d8a9415024

Download Submit
\Users\Admin\AppData\Local\Temp\dfb275e89e3caef87ae62a488e45a7f7.exe

Filesize
64KB

MD5
68fa0d52f328d16cc9c3d2c554e6227d

SHA1
d5068a9e1443ae331cfd6f1d8e4d32c6404abe93

SHA256
b598fb81f53be7ce3ab2ac423b845e7a802cdd93e2fabe32dcccdb7f7c62269f

SHA512
590ff80b621c818ceefb1e9176b9762d981a7f6429cd11feae8374b9b4c9060376e39de3b55d7a538fbdfe2320684fa7c9fc26e8bb4cfeecd293c2733cee50cd

Download Submit
memory/824-0-0x0000000000400000-0x000000000086A000-memory.dmp

Filesize
4.4MB

Download
memory/824-1-0x0000000000400000-0x00000000005F2000-memory.dmp

Filesize
1.9MB

Download
memory/824-2-0x0000000001A60000-0x0000000001B72000-memory.dmp

Filesize
1.1MB

Download
memory/824-16-0x0000000003690000-0x0000000003AFA000-memory.dmp

Filesize
4.4MB

Download
memory/824-15-0x0000000000400000-0x00000000005F2000-memory.dmp

Filesize
1.9MB

Download
memory/824-26-0x0000000003690000-0x0000000003AFA000-memory.dmp

Filesize
4.4MB

Download
memory/1996-18-0x0000000000400000-0x000000000086A000-memory.dmp

Filesize
4.4MB

Download
memory/1996-20-0x0000000000250000-0x0000000000362000-memory.dmp

Filesize
1.1MB

Download
memory/1996-17-0x0000000000400000-0x00000000005F2000-memory.dmp

Filesize
1.9MB

Download
memory/1996-27-0x0000000000400000-0x000000000086A000-memory.dmp

Filesize
4.4MB

Download