Analysis

  • max time kernel
    121s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    30-05-2024 01:35

General

  • Target

    5ee0a73acaf26d83feb96dee4cb124b58609b357913eb9e185476847df89b246.exe

  • Size

    6.9MB

  • MD5

    217d132cff2d881260b9fc0a980217a4

  • SHA1

    25405c345e4e2b96c253b1316dc22a49897a9193

  • SHA256

    5ee0a73acaf26d83feb96dee4cb124b58609b357913eb9e185476847df89b246

  • SHA512

    38d901185ac94e32f0f3bdb3eda80db85d7b16fc96c2f5ab4aeb5904baf4b3dd8cb5db22dba1a1d2fb14a4eeb1d49fd83c926b31948a343f7d7aedcaaa038b73

  • SSDEEP

    98304:MrjkzHqdVfB2FS27wZjyuT/9vUIdD9C+z3zO917vOTh+ezDNh7xvmJ1nmOBN9n4t:Mrj0QsOjbT/9bvLz3S1bA3zgn97vu

Score
7/10
upx

Malware Config

Signatures

  • Loads dropped DLL 1 IoCs
  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5ee0a73acaf26d83feb96dee4cb124b58609b357913eb9e185476847df89b246.exe
    "C:\Users\Admin\AppData\Local\Temp\5ee0a73acaf26d83feb96dee4cb124b58609b357913eb9e185476847df89b246.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1672
    • C:\Users\Admin\AppData\Local\Temp\5ee0a73acaf26d83feb96dee4cb124b58609b357913eb9e185476847df89b246.exe
      "C:\Users\Admin\AppData\Local\Temp\5ee0a73acaf26d83feb96dee4cb124b58609b357913eb9e185476847df89b246.exe"
      2⤵
      • Loads dropped DLL
      PID:3036

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\_MEI16722\python311.dll

    Filesize

    1.6MB

    MD5

    5792adeab1e4414e0129ce7a228eb8b8

    SHA1

    e9f022e687b6d88d20ee96d9509f82e916b9ee8c

    SHA256

    7e1370058177d78a415b7ed113cc15472974440d84267fc44cdc5729535e3967

    SHA512

    c8298b5780a2a5eebed070ac296eda6902b0cac9fda7bb70e21f482d6693d6d2631ca1ac4be96b75ac0dd50c9ca35be5d0aca9c4586ba7e58021edccd482958b

  • memory/3036-23-0x000007FEF5A30000-0x000007FEF6019000-memory.dmp

    Filesize

    5.9MB