e584a4a012e6265435c6dc3b920d3505bb0f852d544ad01b62dda09c97d0f67f

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
21/04/2024, 04:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

e584a4a012e6265435c6dc3b920d3505bb0f852d544ad01b62dda09c97d0f67f.exe
Size

29KB
MD5

0b9f052fe6198b4ef937e574381ca2f2
SHA1

a29c360e4ced49a5820366dd0f387e28f9706711
SHA256

e584a4a012e6265435c6dc3b920d3505bb0f852d544ad01b62dda09c97d0f67f
SHA512

6bc4c98035aadb19e54250dcf7797e72a66c580a1d87e225805b11c1c19cb1bc7e50cc061657a10b3ffbe7011d783fa262220c63de1237840ece93de83532dd1
SSDEEP

384:BCFBJ+AnI5p3dZ4C7HdYwR0MrOk0WSlf2LZK3LsbWoXnKDjD228MD9ipDekL0:kFSl5dnYY7qk0nlfeKoSAnKDWMDQ+

Score

9^/10

upx

Malware Config

Signatures

UPX dump on OEP (original entry point) 4 IoCs

resource	yara_rule
behavioral1/memory/2860-0-0x0000000000400000-0x000000000040D000-memory.dmp	UPX
behavioral1/files/0x000c00000001225d-11.dat	UPX
behavioral1/memory/1248-15-0x0000000000400000-0x000000000040D000-memory.dmp	UPX
behavioral1/memory/1248-25-0x0000000000400000-0x000000000040D000-memory.dmp	UPX

Executes dropped EXE 1 IoCs

pid	Process
1248	hummy.exe

Loads dropped DLL 1 IoCs

pid	Process
2860	e584a4a012e6265435c6dc3b920d3505bb0f852d544ad01b62dda09c97d0f67f.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2860-0-0x0000000000400000-0x000000000040D000-memory.dmp	upx
behavioral1/files/0x000c00000001225d-11.dat	upx
behavioral1/memory/1248-15-0x0000000000400000-0x000000000040D000-memory.dmp	upx
behavioral1/memory/1248-25-0x0000000000400000-0x000000000040D000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2860	e584a4a012e6265435c6dc3b920d3505bb0f852d544ad01b62dda09c97d0f67f.exe
1248	hummy.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2860 wrote to memory of 1248	2860	e584a4a012e6265435c6dc3b920d3505bb0f852d544ad01b62dda09c97d0f67f.exe	28
PID 2860 wrote to memory of 1248	2860	e584a4a012e6265435c6dc3b920d3505bb0f852d544ad01b62dda09c97d0f67f.exe	28
PID 2860 wrote to memory of 1248	2860	e584a4a012e6265435c6dc3b920d3505bb0f852d544ad01b62dda09c97d0f67f.exe	28
PID 2860 wrote to memory of 1248	2860	e584a4a012e6265435c6dc3b920d3505bb0f852d544ad01b62dda09c97d0f67f.exe	28

C:\Users\Admin\AppData\Local\Temp\e584a4a012e6265435c6dc3b920d3505bb0f852d544ad01b62dda09c97d0f67f.exe
"C:\Users\Admin\AppData\Local\Temp\e584a4a012e6265435c6dc3b920d3505bb0f852d544ad01b62dda09c97d0f67f.exe"
1⤵
- Loads dropped DLL
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2860
- C:\Users\Admin\AppData\Local\Temp\hummy.exe
  "C:\Users\Admin\AppData\Local\Temp\hummy.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:1248

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\hummy.exe

Filesize
29KB

MD5
76ac6bc59399bd54f2a671ecfedf13b2

SHA1
b82485a77c96480e5923d095645233f7d2ac21ad

SHA256
117044e929ca20dd03289e741ddc3065bcc199f53a93c4d41a547f2b2a88d9af

SHA512
abd61ca8e64248e1858a5005aa0dd3f16a0330c505a576f7b2a9761a815f1168ccb0d71e2d6c7e42cb4e526f0aabf8e62817fdf80d3d95983cf47bc513c9fe3e

Download Submit
memory/1248-15-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/1248-24-0x0000000000290000-0x0000000000296000-memory.dmp

Filesize
24KB

Download
memory/1248-25-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/2860-0-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/2860-1-0x0000000000310000-0x0000000000316000-memory.dmp

Filesize
24KB

Download
memory/2860-2-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/2860-9-0x0000000000310000-0x0000000000316000-memory.dmp

Filesize
24KB

Download