101109d224c5a91318b8b1478ada4478184a3b34b8f32e56f3d2c4d20b210858

Analysis

max time kernel
119s
max time network
128s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
26-03-2024 20:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e006f82f647d0c511dbd4b0fbdd31531.exe
Size

5.8MB
MD5

e006f82f647d0c511dbd4b0fbdd31531
SHA1

60d5c5c2f98133f15f4b83875f86bc494c5f3a1b
SHA256

101109d224c5a91318b8b1478ada4478184a3b34b8f32e56f3d2c4d20b210858
SHA512

d4facb6e11a7dbc103bb248070f22b869fef972645d2d02a79862db9a63a07e871615f3dbf3a982f3f047d85a32c3cd4b57f1eae604c6b3ca493f42748c4e5d2
SSDEEP

98304:+TXRhwHmpHau42c1joCjMPkNwk6alDAqD7z3uboHau42c1joCjMPkNwk6:+TXRhiMauq1jI86FA7y2auq1jI86

Score

7^/10

upx

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2696	e006f82f647d0c511dbd4b0fbdd31531.exe

Executes dropped EXE 1 IoCs

pid	Process
2696	e006f82f647d0c511dbd4b0fbdd31531.exe

Loads dropped DLL 1 IoCs

pid	Process
2028	e006f82f647d0c511dbd4b0fbdd31531.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2028-0-0x0000000000400000-0x00000000008EF000-memory.dmp	upx
behavioral1/files/0x000a000000012254-10.dat	upx
behavioral1/files/0x000a000000012254-13.dat	upx
behavioral1/memory/2028-15-0x0000000003DE0000-0x00000000042CF000-memory.dmp	upx

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2028	e006f82f647d0c511dbd4b0fbdd31531.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2028	e006f82f647d0c511dbd4b0fbdd31531.exe
2696	e006f82f647d0c511dbd4b0fbdd31531.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2028 wrote to memory of 2696	2028	e006f82f647d0c511dbd4b0fbdd31531.exe	28
PID 2028 wrote to memory of 2696	2028	e006f82f647d0c511dbd4b0fbdd31531.exe	28
PID 2028 wrote to memory of 2696	2028	e006f82f647d0c511dbd4b0fbdd31531.exe	28
PID 2028 wrote to memory of 2696	2028	e006f82f647d0c511dbd4b0fbdd31531.exe	28

C:\Users\Admin\AppData\Local\Temp\e006f82f647d0c511dbd4b0fbdd31531.exe
"C:\Users\Admin\AppData\Local\Temp\e006f82f647d0c511dbd4b0fbdd31531.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2028
- C:\Users\Admin\AppData\Local\Temp\e006f82f647d0c511dbd4b0fbdd31531.exe
  C:\Users\Admin\AppData\Local\Temp\e006f82f647d0c511dbd4b0fbdd31531.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:2696

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\e006f82f647d0c511dbd4b0fbdd31531.exe

Filesize
1.8MB

MD5
949760f7615a08ccaee0894cd0b970a2

SHA1
f9c1fb968a17fc7e7ccdcce49e2971e01b3da2f6

SHA256
fa6523e5cd07678822523181abc2eb9cc5cd35a6fe690f753e17d7aecb9eeef2

SHA512
c1cd69fc5da72182a762b22702212517e94f981aa80ad30ae8d09bd41481b4e637a3412ccc58f64191d117ae133429116b0c4e62b40867ae8d4db91ce5ea7482

Download Submit
\Users\Admin\AppData\Local\Temp\e006f82f647d0c511dbd4b0fbdd31531.exe

Filesize
2.1MB

MD5
3a0ec47d6df5441a800dc483e9d00b7a

SHA1
493e5c105a81a70c4bcf778ff30f3bf589ddf4c1

SHA256
bab7e58c7e739ba418e7d9f3e67cd5b40a579df04d4f7649c16f0bba25b677ca

SHA512
6481510a2aafaa765fd8ba3ea0e286f1fe9fb534119729cfd8792e93a22caea12f665efcdcee1e71a57423cf5359731d50e8c31a809eb7e5d935632354491253

Download Submit
memory/2028-15-0x0000000003DE0000-0x00000000042CF000-memory.dmp

Filesize
4.9MB

Download
memory/2028-2-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/2028-1-0x0000000000130000-0x0000000000263000-memory.dmp

Filesize
1.2MB

Download
memory/2028-14-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/2028-0-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/2028-31-0x0000000003DE0000-0x00000000042CF000-memory.dmp

Filesize
4.9MB

Download
memory/2696-17-0x0000000000400000-0x000000000062A000-memory.dmp

Filesize
2.2MB

Download
memory/2696-19-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download
memory/2696-16-0x0000000001B20000-0x0000000001C53000-memory.dmp

Filesize
1.2MB

Download
memory/2696-24-0x0000000003410000-0x000000000363A000-memory.dmp

Filesize
2.2MB

Download
memory/2696-23-0x0000000000400000-0x000000000061D000-memory.dmp

Filesize
2.1MB

Download
memory/2696-32-0x0000000000400000-0x00000000008EF000-memory.dmp

Filesize
4.9MB

Download