6eee158a3739c38786245f8afb491d92591eb5616dfbe898607fa35bc645f33c

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
27/03/2024, 02:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e0896bc5b3cee2fa264b25f70c883294.exe
Size

2.7MB
MD5

e0896bc5b3cee2fa264b25f70c883294
SHA1

cddcef82dad6d0a8d2aa771b30191464cfd24006
SHA256

6eee158a3739c38786245f8afb491d92591eb5616dfbe898607fa35bc645f33c
SHA512

a7a2cfc630b5c6ff3cb0e4e934a1715d48f8d6a76977f47b3d704a7d92658a1dd6a52ec51d9f71073c4242b0c870de6930845311e70d76879cad1de14e919782
SSDEEP

49152:qokRSNkL2CZwsqFN1OYn0TbbuPvR9TJdlB4011X3rTEK4lhVMqJtKZJhJX9HR9j:qDwkLhOLFvOxTsHTJdzz1HrYK4nm6+Jx

Score

7^/10

upx

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2924	e0896bc5b3cee2fa264b25f70c883294.exe

Executes dropped EXE 1 IoCs

pid	Process
2924	e0896bc5b3cee2fa264b25f70c883294.exe

Loads dropped DLL 1 IoCs

pid	Process
2868	e0896bc5b3cee2fa264b25f70c883294.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2868-0-0x0000000000400000-0x00000000008E7000-memory.dmp	upx
behavioral1/files/0x000a000000012252-10.dat	upx
behavioral1/memory/2924-16-0x0000000000400000-0x00000000008E7000-memory.dmp	upx

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2868	e0896bc5b3cee2fa264b25f70c883294.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2868	e0896bc5b3cee2fa264b25f70c883294.exe
2924	e0896bc5b3cee2fa264b25f70c883294.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2868 wrote to memory of 2924	2868	e0896bc5b3cee2fa264b25f70c883294.exe	28
PID 2868 wrote to memory of 2924	2868	e0896bc5b3cee2fa264b25f70c883294.exe	28
PID 2868 wrote to memory of 2924	2868	e0896bc5b3cee2fa264b25f70c883294.exe	28
PID 2868 wrote to memory of 2924	2868	e0896bc5b3cee2fa264b25f70c883294.exe	28

C:\Users\Admin\AppData\Local\Temp\e0896bc5b3cee2fa264b25f70c883294.exe
"C:\Users\Admin\AppData\Local\Temp\e0896bc5b3cee2fa264b25f70c883294.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2868
- C:\Users\Admin\AppData\Local\Temp\e0896bc5b3cee2fa264b25f70c883294.exe
  C:\Users\Admin\AppData\Local\Temp\e0896bc5b3cee2fa264b25f70c883294.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:2924

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\e0896bc5b3cee2fa264b25f70c883294.exe

Filesize
2.7MB

MD5
f6556c88fc496e25456c7975b8a688b2

SHA1
6815e29d8483b8671b25d68507f7604f2bfae6a1

SHA256
97682aff4698f48e5c7a2360625ca27b791e8ff1215535fb4f5c7ccc2a9c2477

SHA512
5ae9d3756e8288110f5fcb781108badac4331a5d32cfb98daaca65e02bfa6b22846675008cc2b8b00d4ab72585e8d2aee4229f64e316aa712435bdae33459598

Download Submit
memory/2868-13-0x0000000003750000-0x0000000003C37000-memory.dmp

Filesize
4.9MB

Download
memory/2868-2-0x0000000000130000-0x0000000000261000-memory.dmp

Filesize
1.2MB

Download
memory/2868-1-0x0000000000400000-0x0000000000622000-memory.dmp

Filesize
2.1MB

Download
memory/2868-14-0x0000000000400000-0x0000000000622000-memory.dmp

Filesize
2.1MB

Download
memory/2868-0-0x0000000000400000-0x00000000008E7000-memory.dmp

Filesize
4.9MB

Download
memory/2868-31-0x0000000003750000-0x0000000003C37000-memory.dmp

Filesize
4.9MB

Download
memory/2924-16-0x0000000000400000-0x00000000008E7000-memory.dmp

Filesize
4.9MB

Download
memory/2924-18-0x0000000001B10000-0x0000000001C41000-memory.dmp

Filesize
1.2MB

Download
memory/2924-17-0x0000000000400000-0x0000000000622000-memory.dmp

Filesize
2.1MB

Download
memory/2924-23-0x0000000000400000-0x0000000000616000-memory.dmp

Filesize
2.1MB

Download
memory/2924-24-0x00000000033F0000-0x0000000003612000-memory.dmp

Filesize
2.1MB

Download
memory/2924-32-0x0000000000400000-0x00000000008E7000-memory.dmp

Filesize
4.9MB

Download