7de1a314fffec5754d068c873def3e86dfb3f202059b3579128a9912eb75b62d

Analysis

max time kernel
117s
max time network
120s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
09-04-2024 13:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

02396c8d0ba705e42e0a4f1a7b8e151c5093910346746546104d88e81e7e22a5.exe
Size

8.1MB
MD5

cac17fe5ebebfe851a9c9671ec2bbaca
SHA1

efe73a9e3c2c3dd2f7293b81d158249a4d963ebe
SHA256

46be2e0c81fc516a6076789930c53a29471fcc7fd184cdf878b2da5c2c517cac
SHA512

9ec7ce05dd6dc7c521e759a7e40ed477b2e3ae6ec69c84ad8d4f37d48a471bdd0e02bd90b889689343b43330bfd5a98287c189f37515e91c53d0153347be0d89
SSDEEP

49152:omf8odH3hb0t/XrpZi9qiijrsfGWhMBFvQALfmJlI0+s8KuqGaX0ToIBAUZLY6g:z8mXcpZQqDjwfhU9mJlI3JBAUZLq

Score

7^/10

upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
108	setup_33_11002.exe

Loads dropped DLL 1 IoCs

pid	Process
2872	02396c8d0ba705e42e0a4f1a7b8e151c5093910346746546104d88e81e7e22a5.exe

UPX packed file 25 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2872-0-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2872-4-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2872-3-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2872-6-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2872-8-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2872-10-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2872-12-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2872-15-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2872-17-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2872-19-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2872-22-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2872-24-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2872-26-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2872-28-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2872-32-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2872-30-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2872-34-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2872-38-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2872-36-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2872-40-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2872-42-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2872-44-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2872-46-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2872-47-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2872-48-0x0000000010000000-0x000000001003E000-memory.dmp	upx

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
2872	02396c8d0ba705e42e0a4f1a7b8e151c5093910346746546104d88e81e7e22a5.exe
2872	02396c8d0ba705e42e0a4f1a7b8e151c5093910346746546104d88e81e7e22a5.exe
2872	02396c8d0ba705e42e0a4f1a7b8e151c5093910346746546104d88e81e7e22a5.exe
2872	02396c8d0ba705e42e0a4f1a7b8e151c5093910346746546104d88e81e7e22a5.exe
2872	02396c8d0ba705e42e0a4f1a7b8e151c5093910346746546104d88e81e7e22a5.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2872 wrote to memory of 108	2872	02396c8d0ba705e42e0a4f1a7b8e151c5093910346746546104d88e81e7e22a5.exe	30
PID 2872 wrote to memory of 108	2872	02396c8d0ba705e42e0a4f1a7b8e151c5093910346746546104d88e81e7e22a5.exe	30
PID 2872 wrote to memory of 108	2872	02396c8d0ba705e42e0a4f1a7b8e151c5093910346746546104d88e81e7e22a5.exe	30
PID 2872 wrote to memory of 108	2872	02396c8d0ba705e42e0a4f1a7b8e151c5093910346746546104d88e81e7e22a5.exe	30
PID 2872 wrote to memory of 108	2872	02396c8d0ba705e42e0a4f1a7b8e151c5093910346746546104d88e81e7e22a5.exe	30
PID 2872 wrote to memory of 108	2872	02396c8d0ba705e42e0a4f1a7b8e151c5093910346746546104d88e81e7e22a5.exe	30
PID 2872 wrote to memory of 108	2872	02396c8d0ba705e42e0a4f1a7b8e151c5093910346746546104d88e81e7e22a5.exe	30

C:\Users\Admin\AppData\Local\Temp\02396c8d0ba705e42e0a4f1a7b8e151c5093910346746546104d88e81e7e22a5.exe
"C:\Users\Admin\AppData\Local\Temp\02396c8d0ba705e42e0a4f1a7b8e151c5093910346746546104d88e81e7e22a5.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2872
- C:\Users\Admin\AppData\Local\Temp\setup_33_11002.exe
  C:\Users\Admin\AppData\Local\Temp\/setup_33_11002.exe
  2⤵
  - Executes dropped EXE
  PID:108

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\setup_33_11002.exe

Filesize
694KB

MD5
371e59bf3e736ed4d0208dc4acd106d3

SHA1
a5cf12854db4d278e5451aa7b4ec2459f0d26d1d

SHA256
65b4ac4547ba560d2295007216e1215a825d076b3656f20d751f13bd7c2ba049

SHA512
a5aa61a2d43ac3ac9c50ab3ef1bde2f012e5138de3791fd6ed87d8c1eb1a5970131153c6074165d8eaf1cafc5d8fc470eb005ba94eac879964d75f27de94d1d2

Download Submit
memory/108-55-0x0000000000100000-0x0000000000101000-memory.dmp

Filesize
4KB

Download
memory/108-54-0x0000000037470000-0x0000000037480000-memory.dmp

Filesize
64KB

Download
memory/2872-28-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2872-30-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2872-8-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2872-10-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2872-12-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2872-15-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2872-17-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2872-19-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2872-22-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2872-24-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2872-26-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2872-1-0x0000000000400000-0x0000000000C76000-memory.dmp

Filesize
8.5MB

Download
memory/2872-32-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2872-6-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2872-34-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2872-38-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2872-36-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2872-40-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2872-42-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2872-44-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2872-46-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2872-47-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2872-48-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2872-3-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2872-4-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2872-0-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2872-58-0x0000000000400000-0x0000000000C76000-memory.dmp

Filesize
8.5MB

Download