d9c727b58f65bd9a37155b760078d827b0d444769ec055cfae7b3d0889205779

Analysis

max time kernel
19s
max time network
17s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
14/07/2024, 16:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0988b5532a47fd87a6993b15b4679500N.exe
Size

59KB
MD5

0988b5532a47fd87a6993b15b4679500
SHA1

8a51bf8dd7668ab4964e79ebbb0e47d515fb80e4
SHA256

d9c727b58f65bd9a37155b760078d827b0d444769ec055cfae7b3d0889205779
SHA512

351a7ee29dc5177a6780d843190329a15e2d92e63713d4eba8f0a3c7141614d4b2ca9399d0e05c8efd993df88575a192cd1facb7945d6d0a4b1489f5967e81b4
SSDEEP

1536:14vnuZU68CrFQmhRYJtgQJJfJc425qIAoW5kDZ:UuKUr2mTAgMujIaW

Score

7^/10

upx

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1708	0988b5532a47fd87a6993b15b4679500N.exe

Executes dropped EXE 1 IoCs

pid	Process
1708	0988b5532a47fd87a6993b15b4679500N.exe

Loads dropped DLL 1 IoCs

pid	Process
3056	0988b5532a47fd87a6993b15b4679500N.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/3056-0-0x0000000000400000-0x000000000043D000-memory.dmp	upx
behavioral1/memory/3056-16-0x00000000001F0000-0x000000000022D000-memory.dmp	upx
behavioral1/files/0x000a00000001202e-7.dat	upx
behavioral1/memory/1708-17-0x0000000000400000-0x000000000043D000-memory.dmp	upx

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3056	0988b5532a47fd87a6993b15b4679500N.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
3056	0988b5532a47fd87a6993b15b4679500N.exe
1708	0988b5532a47fd87a6993b15b4679500N.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3056 wrote to memory of 1708	3056	0988b5532a47fd87a6993b15b4679500N.exe	31
PID 3056 wrote to memory of 1708	3056	0988b5532a47fd87a6993b15b4679500N.exe	31
PID 3056 wrote to memory of 1708	3056	0988b5532a47fd87a6993b15b4679500N.exe	31
PID 3056 wrote to memory of 1708	3056	0988b5532a47fd87a6993b15b4679500N.exe	31

C:\Users\Admin\AppData\Local\Temp\0988b5532a47fd87a6993b15b4679500N.exe
"C:\Users\Admin\AppData\Local\Temp\0988b5532a47fd87a6993b15b4679500N.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3056
- C:\Users\Admin\AppData\Local\Temp\0988b5532a47fd87a6993b15b4679500N.exe
  C:\Users\Admin\AppData\Local\Temp\0988b5532a47fd87a6993b15b4679500N.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:1708

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\0988b5532a47fd87a6993b15b4679500N.exe

Filesize
59KB

MD5
367da5911816acfb9c18734a970a1606

SHA1
78559f5cb3426329e989d0051bdb115f26d2b604

SHA256
5444dae4f7accf37ec94dfb9d32e9165c35325e197ad19b5ec3659c33c8a4201

SHA512
0ed2ad68d40e010106e1dfb0282c84b11726f4f33da3744896ccd1a8c22f1ba35b930465943abdb68a9ef0acd7bdd2028a826a724fb07c62a32d1f24f15acff3

Download Submit
memory/1708-17-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/1708-24-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/1708-19-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/1708-18-0x0000000000030000-0x000000000003F000-memory.dmp

Filesize
60KB

Download
memory/1708-29-0x00000000003B0000-0x00000000003CD000-memory.dmp

Filesize
116KB

Download
memory/1708-31-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/3056-16-0x00000000001F0000-0x000000000022D000-memory.dmp

Filesize
244KB

Download
memory/3056-1-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/3056-14-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/3056-11-0x0000000000030000-0x000000000003F000-memory.dmp

Filesize
60KB

Download
memory/3056-0-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/3056-30-0x00000000001F0000-0x000000000022D000-memory.dmp

Filesize
244KB

Download