9da29ec36ba8d2cbe02e488b6279b8196b7108b2fadc05911b4eb7c2bd8a263f

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28-05-2024 13:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

CollapseLoader_85fdbf8.exe
Size

11.0MB
MD5

58330dc95cf48db43bf6c73bcee2cd18
SHA1

f22f28f8cb29e279b38956252ec473e53ae72ae7
SHA256

9da29ec36ba8d2cbe02e488b6279b8196b7108b2fadc05911b4eb7c2bd8a263f
SHA512

728fbd03a02680c6000c198e9431cc76af6405c81fb3edb2f8dc6587927b01bbfa33248284446e7fba4ccf224391281c3841a9b074b6943d7bbcd8788f92f828
SSDEEP

196608:zn40eofXnxurErvI9pWjl1D1DEzx7sKbSEncvAkj0WllGO3zYUcTupNFnELKId:HjfBurEUWjP5EhydIKZyupvYZd

Score

7^/10

upx

Malware Config

Signatures

Loads dropped DLL 7 IoCs

Processes:

CollapseLoader_85fdbf8.exe

pid	process
2548	CollapseLoader_85fdbf8.exe
2548	CollapseLoader_85fdbf8.exe
2548	CollapseLoader_85fdbf8.exe
2548	CollapseLoader_85fdbf8.exe
2548	CollapseLoader_85fdbf8.exe
2548	CollapseLoader_85fdbf8.exe
2548	CollapseLoader_85fdbf8.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\_MEI20842\python312.dll	upx
behavioral1/memory/2548-77-0x000007FEF5F80000-0x000007FEF6659000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

CollapseLoader_85fdbf8.exe

description	pid	process	target process
PID 2084 wrote to memory of 2548	2084	CollapseLoader_85fdbf8.exe	CollapseLoader_85fdbf8.exe
PID 2084 wrote to memory of 2548	2084	CollapseLoader_85fdbf8.exe	CollapseLoader_85fdbf8.exe
PID 2084 wrote to memory of 2548	2084	CollapseLoader_85fdbf8.exe	CollapseLoader_85fdbf8.exe

C:\Users\Admin\AppData\Local\Temp\CollapseLoader_85fdbf8.exe
"C:\Users\Admin\AppData\Local\Temp\CollapseLoader_85fdbf8.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2084

C:\Users\Admin\AppData\Local\Temp\CollapseLoader_85fdbf8.exe
"C:\Users\Admin\AppData\Local\Temp\CollapseLoader_85fdbf8.exe"
2⤵
- Loads dropped DLL
PID:2548

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:1800

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_MEI20842\api-ms-win-core-file-l1-2-0.dll
Filesize
13KB

MD5
fa6953700659b11c2d82fb521d2e8664

SHA1
07c7d14fdfd1686a424820f77733d1d4f3c75e31

SHA256
4dcc72554ffaa121decaf6e5bd3081198f017d735a07cc6d23d8a56b1383a61e

SHA512
1300c6ab6377e717dfac9e2f78c1218dee91e8fde25454f65ab32095a949c1be5b67aa3ed1c1d9f78d0c8bc9830f5c1dc0e6e01e91effec20ead6cdd9a3f639f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI20842\api-ms-win-core-file-l2-1-0.dll
Filesize
13KB

MD5
621a34a36c202e4c4e59a6077c22cb5e

SHA1
ec696fd4e8e5935a722e88a551593593a12e882e

SHA256
746cde47f460ab4ef45a3158cbc038b166c86b03114c259ea5c759001692c079

SHA512
04e94784a70a576235d5bec58c57b8b3cfc01d7b292287f299deaf52523cef51c2790874116e666e5bc672453beafe173cf1afbe49a5f3076b83344298643ae0

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI20842\api-ms-win-core-localization-l1-2-0.dll
Filesize
15KB

MD5
2395f675152f25bdc501c1b698b3f70a

SHA1
829eb4dee9604330072c124b9bddf4a4e96a7c98

SHA256
4173e50962540ec0708930d7c456164d4e0fa96d49efb034621eb06e67ac0563

SHA512
7c0125e248387d268a337fa2a0090e6b8713e6205d22fb23a4ce9635fb0f5b79a0e3d28aab3050cc0445ef065632052c23341b1ac22dbd947ac4262fd63a1b51

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI20842\api-ms-win-core-processthreads-l1-1-1.dll
Filesize
13KB

MD5
81a255549e9b3467276810f94a67512d

SHA1
c3bf694f5d030d5a29ebb9ae70010be4571cec17

SHA256
8447c3c56f83e5a9407bf446cfc037d149b945611f03798f731e49145fca81c2

SHA512
05e6d83baa20b38d8710ed06c62ef8603c37d70fd0f6036f54a50ad041575d52f23c56bcebb12df8bf7cd9327c46522e59bcda47e2fcabfb0e5c11247708afa4

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI20842\api-ms-win-core-timezone-l1-1-0.dll
Filesize
13KB

MD5
59f3aeb2eda80ffc000b99f27ec99d14

SHA1
2961c514b480424b3512d424dcd7d295477b243a

SHA256
e1c41c6525ed510aa75ec671f86d22a005ffd9a856a74dcf09bf3256e301a8ab

SHA512
ff1980c859c7a23ded484a51e596fd591df855e0266961c4620373d42190152f92df83683779a79561d46bd5d238d7d178cfa2952dee316a742a72835be44992

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI20842\python312.dll
Filesize
1.8MB

MD5
f8a73b023a10c10a060bea2b1134050d

SHA1
58ccd5d0f26bc52f4ea5ba2df035661da7d980b4

SHA256
c905061019b513e576ad98585c71f876c4cebd1da51906c6123980e3b33ab5e2

SHA512
fab9a6be342fcbec07093552d59101ef1f0536c87114297154455ff73afb95de30318fd3d33906fffbaa8f3964aa443a8b386cbc7b586d91f1ca05567db98453

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI20842\ucrtbase.dll
Filesize
987KB

MD5
637c17ad8bccc838b0cf83ffb8e2c7fd

SHA1
b2dd2890668e589badb2ba61a27c1da503d73c39

SHA256
be7368df484688493fb49fb0c4ad641485070190db62a2c071c9c50612e43fed

SHA512
f6b727c319ca2e85a9b5c5e0b9d8b9023f0cf4193fab983cfa26060923374c6abd6d11db1da2e524a8b04622a4e13beb4c48dc23f98886d4abb33eb09f3a0776

Download Submit
memory/2548-77-0x000007FEF5F80000-0x000007FEF6659000-memory.dmp

Filesize
6.8MB

Download
memory/2548-134-0x000007FEF5F80000-0x000007FEF6659000-memory.dmp

Filesize
6.8MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads