20f1309fb65fb14af8704b09dce4fc48de5418a3c8b8446599f371952591ae97

Analysis

max time kernel
140s
max time network
130s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
20/05/2024, 10:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

20f1309fb65fb14af8704b09dce4fc48de5418a3c8b8446599f371952591ae97.exe
Size

1.2MB
MD5

a76a2b78e12e6f6e10699160f641e176
SHA1

ba0afe70d11db65544cf4e02f422cdb6418eb940
SHA256

20f1309fb65fb14af8704b09dce4fc48de5418a3c8b8446599f371952591ae97
SHA512

3c8e18caf18db7449b4224bb69a80b97777da3c7d6b97ee2b23a8a7aac344e0d68d17a24c434c8280f3b078a0745ffe1d6c2a1408b006a82a9f1b474abdeb2fd
SSDEEP

12288:n/v/unTrVi5spyeCzqr1+capAaImjpxxjRjuFdBpu3uEF/BhDd447ZXtbZ4bklHa:nWn9i+pvCzqR+RpfKFdB1oBhNdbxl6

Score

7^/10

upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3036	admin.exe

UPX packed file 14 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1680-3-0x0000000002090000-0x00000000021A5000-memory.dmp	upx
behavioral1/files/0x000b00000001228a-6.dat	upx
behavioral1/memory/3036-12-0x0000000000400000-0x0000000000515000-memory.dmp	upx
behavioral1/memory/1680-15-0x0000000002090000-0x00000000021A5000-memory.dmp	upx
behavioral1/memory/3036-19-0x0000000000400000-0x0000000000515000-memory.dmp	upx
behavioral1/memory/3036-20-0x0000000000400000-0x0000000000515000-memory.dmp	upx
behavioral1/memory/3036-21-0x0000000000400000-0x0000000000515000-memory.dmp	upx
behavioral1/memory/3036-22-0x0000000000400000-0x0000000000515000-memory.dmp	upx
behavioral1/memory/3036-27-0x0000000000400000-0x0000000000515000-memory.dmp	upx
behavioral1/memory/3036-28-0x0000000000400000-0x0000000000515000-memory.dmp	upx
behavioral1/memory/3036-29-0x0000000000400000-0x0000000000515000-memory.dmp	upx
behavioral1/memory/3036-30-0x0000000000400000-0x0000000000515000-memory.dmp	upx
behavioral1/memory/3036-35-0x0000000000400000-0x0000000000515000-memory.dmp	upx
behavioral1/memory/3036-36-0x0000000000400000-0x0000000000515000-memory.dmp	upx

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1680	20f1309fb65fb14af8704b09dce4fc48de5418a3c8b8446599f371952591ae97.exe
1680	20f1309fb65fb14af8704b09dce4fc48de5418a3c8b8446599f371952591ae97.exe
3036	admin.exe
3036	admin.exe
3036	admin.exe
1680	20f1309fb65fb14af8704b09dce4fc48de5418a3c8b8446599f371952591ae97.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1680	20f1309fb65fb14af8704b09dce4fc48de5418a3c8b8446599f371952591ae97.exe
1680	20f1309fb65fb14af8704b09dce4fc48de5418a3c8b8446599f371952591ae97.exe
3036	admin.exe
3036	admin.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1680 wrote to memory of 3036	1680	20f1309fb65fb14af8704b09dce4fc48de5418a3c8b8446599f371952591ae97.exe	28
PID 1680 wrote to memory of 3036	1680	20f1309fb65fb14af8704b09dce4fc48de5418a3c8b8446599f371952591ae97.exe	28
PID 1680 wrote to memory of 3036	1680	20f1309fb65fb14af8704b09dce4fc48de5418a3c8b8446599f371952591ae97.exe	28
PID 1680 wrote to memory of 3036	1680	20f1309fb65fb14af8704b09dce4fc48de5418a3c8b8446599f371952591ae97.exe	28

C:\Users\Admin\AppData\Local\Temp\20f1309fb65fb14af8704b09dce4fc48de5418a3c8b8446599f371952591ae97.exe
"C:\Users\Admin\AppData\Local\Temp\20f1309fb65fb14af8704b09dce4fc48de5418a3c8b8446599f371952591ae97.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1680
- \??\c:\admin.exe
  c:\admin.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:3036

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\admin.exe

Filesize
372KB

MD5
9ed304603b3c00d5168b76a0b61332f0

SHA1
50f57ac837f9a325058a73181a4d33e2a66b4f8d

SHA256
1ce90640766c1c1bb7d18fc94f429b794811d11d1a0b627696ab07f9075f7114

SHA512
b96358c2c8950454c5ef17438ecd02525d116447af6ecefa9cdaaddd7b18634c46b23252d3d26f3c46c50df470ed9a405f652c53798e0d6a39c28f6a112d5af4

Download Submit
memory/1680-15-0x0000000002090000-0x00000000021A5000-memory.dmp

Filesize
1.1MB

Download
memory/1680-3-0x0000000002090000-0x00000000021A5000-memory.dmp

Filesize
1.1MB

Download
memory/1680-8-0x0000000002090000-0x00000000021A5000-memory.dmp

Filesize
1.1MB

Download
memory/1680-0-0x0000000000400000-0x0000000000570000-memory.dmp

Filesize
1.4MB

Download
memory/1680-13-0x0000000000400000-0x0000000000570000-memory.dmp

Filesize
1.4MB

Download
memory/3036-20-0x0000000000400000-0x0000000000515000-memory.dmp

Filesize
1.1MB

Download
memory/3036-19-0x0000000000400000-0x0000000000515000-memory.dmp

Filesize
1.1MB

Download
memory/3036-12-0x0000000000400000-0x0000000000515000-memory.dmp

Filesize
1.1MB

Download
memory/3036-21-0x0000000000400000-0x0000000000515000-memory.dmp

Filesize
1.1MB

Download
memory/3036-22-0x0000000000400000-0x0000000000515000-memory.dmp

Filesize
1.1MB

Download
memory/3036-27-0x0000000000400000-0x0000000000515000-memory.dmp

Filesize
1.1MB

Download
memory/3036-28-0x0000000000400000-0x0000000000515000-memory.dmp

Filesize
1.1MB

Download
memory/3036-29-0x0000000000400000-0x0000000000515000-memory.dmp

Filesize
1.1MB

Download
memory/3036-30-0x0000000000400000-0x0000000000515000-memory.dmp

Filesize
1.1MB

Download
memory/3036-35-0x0000000000400000-0x0000000000515000-memory.dmp

Filesize
1.1MB

Download
memory/3036-36-0x0000000000400000-0x0000000000515000-memory.dmp

Filesize
1.1MB

Download