ae9685dd6230079d38813e4c57127504bdf811198706d4d854e123b465f17a34

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
07/05/2024, 01:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ae9685dd6230079d38813e4c57127504bdf811198706d4d854e123b465f17a34.exe
Size

18.5MB
MD5

602f7f77e7f19dcc8dfbace2d06c797e
SHA1

a2964c0c7758dd1a52fa61f5e9a5f3e9d14cacdd
SHA256

ae9685dd6230079d38813e4c57127504bdf811198706d4d854e123b465f17a34
SHA512

0a3a655c2082d3242b15e250cb8f420fb24ae626ea6f6ec00de8fe576ecdfe7b1d58b8deeb9644f46fd6b37846ffd96c5fb2971ed4ffe288c30b290a16fb611b
SSDEEP

393216:XqPnLFXlrPzyZQ8DOETgs3nefGFqgWASqvEPgYgZq:aPLFXNLyZQhE3MtpZh

Score

7^/10

upx

Malware Config

Signatures

Loads dropped DLL 7 IoCs

pid	Process
2544	ae9685dd6230079d38813e4c57127504bdf811198706d4d854e123b465f17a34.exe
2544	ae9685dd6230079d38813e4c57127504bdf811198706d4d854e123b465f17a34.exe
2544	ae9685dd6230079d38813e4c57127504bdf811198706d4d854e123b465f17a34.exe
2544	ae9685dd6230079d38813e4c57127504bdf811198706d4d854e123b465f17a34.exe
2544	ae9685dd6230079d38813e4c57127504bdf811198706d4d854e123b465f17a34.exe
2544	ae9685dd6230079d38813e4c57127504bdf811198706d4d854e123b465f17a34.exe
2544	ae9685dd6230079d38813e4c57127504bdf811198706d4d854e123b465f17a34.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000500000001a4bb-163.dat	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1976 wrote to memory of 2544	1976	ae9685dd6230079d38813e4c57127504bdf811198706d4d854e123b465f17a34.exe	28
PID 1976 wrote to memory of 2544	1976	ae9685dd6230079d38813e4c57127504bdf811198706d4d854e123b465f17a34.exe	28
PID 1976 wrote to memory of 2544	1976	ae9685dd6230079d38813e4c57127504bdf811198706d4d854e123b465f17a34.exe	28

C:\Users\Admin\AppData\Local\Temp\ae9685dd6230079d38813e4c57127504bdf811198706d4d854e123b465f17a34.exe
"C:\Users\Admin\AppData\Local\Temp\ae9685dd6230079d38813e4c57127504bdf811198706d4d854e123b465f17a34.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1976
- C:\Users\Admin\AppData\Local\Temp\ae9685dd6230079d38813e4c57127504bdf811198706d4d854e123b465f17a34.exe
  "C:\Users\Admin\AppData\Local\Temp\ae9685dd6230079d38813e4c57127504bdf811198706d4d854e123b465f17a34.exe"
  2⤵
  - Loads dropped DLL
  PID:2544

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_MEI19762\api-ms-win-core-file-l1-2-0.dll

Filesize
11KB

MD5
1f72ba20e6771fe77dd27a3007801d37

SHA1
db0eb1b03f742ca62eeebca6b839fdb51f98a14f

SHA256
0ae3ee32f44aaed5389cc36d337d57d0203224fc6808c8a331a12ec4955bb2f4

SHA512
13e802aef851b59e609bf1dbd3738273ef6021c663c33b61e353b489e7ba2e3d3e61838e6c316fbf8a325fce5d580223cf6a9e61e36cdca90f138cfd7200bb27

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI19762\api-ms-win-core-file-l2-1-0.dll

Filesize
11KB

MD5
c3408e38a69dc84d104ce34abf2dfe5b

SHA1
8c01bd146cfd7895769e3862822edb838219edab

SHA256
0bf0f70bd2b599ed0d6c137ce48cf4c419d15ee171f5faeac164e3b853818453

SHA512
aa47871bc6ebf02de3fe1e1a4001870525875b4f9d4571561933ba90756c17107ddf4d00fa70a42e0ae9054c8a2a76d11f44b683d92ffd773cab6cdc388e9b99

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI19762\api-ms-win-core-localization-l1-2-0.dll

Filesize
14KB

MD5
75ef38b27be5fa07dc07ca44792edcc3

SHA1
7392603b8c75a57857e5b5773f2079cb9da90ee9

SHA256
659f3321f272166f0b079775df0abdaf1bc482d1bcc66f42cae08fde446eb81a

SHA512
78b485583269b3721a89d4630d746a1d9d0488e73f58081c7bdc21948abf830263e6c77d9f31a8ad84ecb5ff02b0922cb39f3824ccd0e0ed026a5e343a8427bc

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI19762\api-ms-win-core-processthreads-l1-1-1.dll

Filesize
12KB

MD5
a55abf3646704420e48c8e29ccde5f7c

SHA1
c2ac5452adbc8d565ad2bc9ec0724a08b449c2d8

SHA256
c2f296dd8372681c37541b0ca8161b4621037d5318b7b8c5346cf7b8a6e22c3e

SHA512
c8eb3ec20821ae4403d48bb5dbf2237428016f23744f7982993a844c53ae89d06f86e03ab801e5aee441a83a82a7c591c0de6a7d586ea1f8c20a2426fced86f0

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI19762\api-ms-win-core-timezone-l1-1-0.dll

Filesize
12KB

MD5
e8af200a0127e12445eb8004a969fc1d

SHA1
a770fe20e42e2bef641c0591c0e763c1c8ba404d

SHA256
64d1ca4ead666023681929d86db26cfd3c70d4b2e521135205a84001d25187db

SHA512
a49b1ce5faf98af719e3a02cd1ff2a7ced1afc4fbf7483beab3f65487d79acc604a0db7c6ee21e45366e93f03fb109126ef00716624c159f1c35e4c100853eaf

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI19762\python310.dll

Filesize
1.4MB

MD5
69d4f13fbaeee9b551c2d9a4a94d4458

SHA1
69540d8dfc0ee299a7ff6585018c7db0662aa629

SHA256
801317463bd116e603878c7c106093ba7db2bece11e691793e93065223fc7046

SHA512
8e632f141daf44bc470f8ee677c6f0fdcbcacbfce1472d928576bf7b9f91d6b76639d18e386d5e1c97e538a8fe19dd2d22ea47ae1acf138a0925e3c6dd156378

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI19762\ucrtbase.dll

Filesize
993KB

MD5
9679f79d724bcdbd3338824ffe8b00c7

SHA1
5ded91cc6e3346f689d079594cf3a9bf1200bd61

SHA256
962c50afcb9fbfd0b833e0d2d7c2ba5cb35cd339ecf1c33ddfb349253ff95f36

SHA512
74ac8deb4a30f623af1e90e594d66fe28a1f86a11519c542c2bad44e556b2c5e03d41842f34f127f8f7f7cb217a6f357604cb2dc6aa5edc5cba8b83673d8b8bd

Download Submit
memory/2544-165-0x000007FEF61B0000-0x000007FEF661E000-memory.dmp

Filesize
4.4MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads