1c22cb4dcbfa11bf2d3c0f8f0ce747ed5990b08efbf7ac104f8d22f4a733cad1

Analysis

max time kernel
146s
max time network
146s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
11/07/2024, 20:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1c22cb4dcbfa11bf2d3c0f8f0ce747ed5990b08efbf7ac104f8d22f4a733cad1.exe
Size

16.9MB
MD5

33bf73ec35249d19b3be991e45476ca9
SHA1

2a7d69870a4f32e5f67139dfd27c4e3460cc3675
SHA256

1c22cb4dcbfa11bf2d3c0f8f0ce747ed5990b08efbf7ac104f8d22f4a733cad1
SHA512

ae5b9bda9e21f03192a6eb651154307b0cbf9d920e173b702b5a044f5e93223cf0a999ea24dabdb24bf802d6518f17d9f11e3592432fbfda0d3ec2d2113f3ec1
SSDEEP

49152:ywHUupes/mJK08VYYPhBt39mAhZPHtMBvdprol/VZjxb35fGm/U7XDgPF4x9Jfzk:yA

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2156-18-0x0000000013140000-0x00000000145E8000-memory.dmp	upx
behavioral1/memory/2156-19-0x0000000013140000-0x00000000145E8000-memory.dmp	upx
behavioral1/memory/2156-20-0x0000000013140000-0x00000000145E8000-memory.dmp	upx
behavioral1/memory/2156-16-0x0000000013140000-0x00000000145E8000-memory.dmp	upx
behavioral1/memory/2156-21-0x0000000013140000-0x00000000145E8000-memory.dmp	upx
behavioral1/memory/2156-24-0x0000000013140000-0x00000000145E8000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2392 set thread context of 2156	2392	1c22cb4dcbfa11bf2d3c0f8f0ce747ed5990b08efbf7ac104f8d22f4a733cad1.exe	31

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2392 wrote to memory of 2156	2392	1c22cb4dcbfa11bf2d3c0f8f0ce747ed5990b08efbf7ac104f8d22f4a733cad1.exe	31
PID 2392 wrote to memory of 2156	2392	1c22cb4dcbfa11bf2d3c0f8f0ce747ed5990b08efbf7ac104f8d22f4a733cad1.exe	31
PID 2392 wrote to memory of 2156	2392	1c22cb4dcbfa11bf2d3c0f8f0ce747ed5990b08efbf7ac104f8d22f4a733cad1.exe	31
PID 2392 wrote to memory of 2156	2392	1c22cb4dcbfa11bf2d3c0f8f0ce747ed5990b08efbf7ac104f8d22f4a733cad1.exe	31
PID 2392 wrote to memory of 2156	2392	1c22cb4dcbfa11bf2d3c0f8f0ce747ed5990b08efbf7ac104f8d22f4a733cad1.exe	31
PID 2392 wrote to memory of 2156	2392	1c22cb4dcbfa11bf2d3c0f8f0ce747ed5990b08efbf7ac104f8d22f4a733cad1.exe	31

C:\Users\Admin\AppData\Local\Temp\1c22cb4dcbfa11bf2d3c0f8f0ce747ed5990b08efbf7ac104f8d22f4a733cad1.exe
"C:\Users\Admin\AppData\Local\Temp\1c22cb4dcbfa11bf2d3c0f8f0ce747ed5990b08efbf7ac104f8d22f4a733cad1.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2392
- C:\windows\syswow64\grpconv.exe
  C:\windows\syswow64\grpconv.exe
  2⤵
  PID:2156

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2156-13-0x0000000013140000-0x00000000145E8000-memory.dmp

Filesize
20.7MB

Download
memory/2156-24-0x0000000013140000-0x00000000145E8000-memory.dmp

Filesize
20.7MB

Download
memory/2156-21-0x0000000013140000-0x00000000145E8000-memory.dmp

Filesize
20.7MB

Download
memory/2156-16-0x0000000013140000-0x00000000145E8000-memory.dmp

Filesize
20.7MB

Download
memory/2156-20-0x0000000013140000-0x00000000145E8000-memory.dmp

Filesize
20.7MB

Download
memory/2156-19-0x0000000013140000-0x00000000145E8000-memory.dmp

Filesize
20.7MB

Download
memory/2156-14-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2156-18-0x0000000013140000-0x00000000145E8000-memory.dmp

Filesize
20.7MB

Download
memory/2392-5-0x0000000000400000-0x00000000014E8000-memory.dmp

Filesize
16.9MB

Download
memory/2392-12-0x0000000000400000-0x00000000014E8000-memory.dmp

Filesize
16.9MB

Download
memory/2392-11-0x0000000000400000-0x00000000014E8000-memory.dmp

Filesize
16.9MB

Download
memory/2392-10-0x0000000000400000-0x00000000014E8000-memory.dmp

Filesize
16.9MB

Download
memory/2392-7-0x0000000000400000-0x00000000014E8000-memory.dmp

Filesize
16.9MB

Download
memory/2392-6-0x0000000000400000-0x00000000014E8000-memory.dmp

Filesize
16.9MB

Download
memory/2392-0-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2392-4-0x0000000000400000-0x00000000014E8000-memory.dmp

Filesize
16.9MB

Download
memory/2392-3-0x0000000000400000-0x00000000014E8000-memory.dmp

Filesize
16.9MB

Download
memory/2392-22-0x0000000000400000-0x00000000014E8000-memory.dmp

Filesize
16.9MB

Download
memory/2392-1-0x0000000000400000-0x00000000014E8000-memory.dmp

Filesize
16.9MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads