0e06e9585cc9db33ee999ca4de668ab64ef6e9fa928ae6541b2f1ec68ff09da8

Submit
Reports

Overview

overview

Static

static

0297bbb0f0...ee.exe

windows7-x64

0297bbb0f0...ee.exe

windows10-2004-x64

15aeb8380c...71.exe

windows7-x64

15aeb8380c...71.exe

windows10-2004-x64

1820a0542f...34.dll

windows7-x64

1820a0542f...34.dll

windows10-2004-x64

1df11bc19a...ad.exe

windows7-x64

1df11bc19a...ad.exe

windows10-2004-x64

22934e006b...e7.exe

windows7-x64

22934e006b...e7.exe

windows10-2004-x64

24989d884f...b7.exe

windows7-x64

24989d884f...b7.exe

windows10-2004-x64

2828fabf39...65.dll

windows7-x64

2828fabf39...65.dll

windows10-2004-x64

32b0fbaf95...08.exe

windows7-x64

32b0fbaf95...08.exe

windows10-2004-x64

4bf2dace8a...d7.exe

windows7-x64

4bf2dace8a...d7.exe

windows10-2004-x64

55d03f9954...44.dll

windows7-x64

55d03f9954...44.dll

windows10-2004-x64

5e58e3818a...cb.exe

windows7-x64

5e58e3818a...cb.exe

windows10-2004-x64

611cf2be67...47.exe

windows7-x64

611cf2be67...47.exe

windows10-2004-x64

654e574fb4...01.exe

windows7-x64

654e574fb4...01.exe

windows10-2004-x64

6f4ac0da34...a5.exe

windows7-x64

6f4ac0da34...a5.exe

windows10-2004-x64

$PLUGINSDI...em.dll

windows7-x64

$PLUGINSDI...em.dll

windows10-2004-x64

$PLUGINSDI...gs.dll

windows7-x64

$PLUGINSDI...gs.dll

windows10-2004-x64

Resubmissions

04-10-2024 16:44

27-09-2024 16:54

27-09-2024 16:44

04-08-2024 18:04

03-08-2024 17:26

03-08-2024 16:14

03-08-2024 15:52

31-07-2024 19:40

31-07-2024 10:53

Analysis

max time kernel
15s
max time network
16s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
03-08-2024 17:26

Sharing

Copy URL

Twitter E-mail

Static task

static1

9 signatures

Behavioral task

behavioral1

Sample

0297bbb0f00b3f591894ebcf042f2c6b0ed52e6662def1a9dbca0f8d20133cee.exe

Resource

win7-20240708-en

discovery

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral2

Sample

0297bbb0f00b3f591894ebcf042f2c6b0ed52e6662def1a9dbca0f8d20133cee.exe

Resource

win10v2004-20240802-en

discovery

windows10-2004-x64

2 signatures

150 seconds

Behavioral task

behavioral3

Sample

15aeb8380c7b5b50ed1e2ff29c342cfe5c29a26554020001f7f9f1449f996e71.exe

Resource

win7-20240705-en

smokeloader backdoor discovery trojan

windows7-x64

4 signatures

150 seconds

Behavioral task

behavioral4

Sample

15aeb8380c7b5b50ed1e2ff29c342cfe5c29a26554020001f7f9f1449f996e71.exe

Resource

win10v2004-20240802-en

smokeloader backdoor discovery trojan

windows10-2004-x64

5 signatures

150 seconds

Behavioral task

behavioral5

Sample

1820a0542f5950fd92ffa787cf09377a14d0fb42f0fa7419366090a5771a5f34.dll

Resource

win7-20240708-en

icedid 1910897067 banker loader trojan

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral6

Sample

1820a0542f5950fd92ffa787cf09377a14d0fb42f0fa7419366090a5771a5f34.dll

Resource

win10v2004-20240802-en

icedid 1910897067 banker loader trojan

windows10-2004-x64

2 signatures

150 seconds

Behavioral task

behavioral7

Sample

1df11bc19aa52b623bdf15380e3fded56d8eb6fb7b53a2240779864b1a6474ad.exe

Resource

win7-20240729-en

upx

windows7-x64

1 signatures

150 seconds

Behavioral task

behavioral8

Sample

1df11bc19aa52b623bdf15380e3fded56d8eb6fb7b53a2240779864b1a6474ad.exe

Resource

win10v2004-20240802-en

upx

windows10-2004-x64

1 signatures

150 seconds

Behavioral task

behavioral9

Sample

22934e006b3f1b8225c51a93ce0acaa1874c4f1dc895fa1664bdf16b0065d2e7.exe

Resource

win7-20240708-en

discovery

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral10

Sample

22934e006b3f1b8225c51a93ce0acaa1874c4f1dc895fa1664bdf16b0065d2e7.exe

Resource

win10v2004-20240802-en

discovery

windows10-2004-x64

2 signatures

150 seconds

Behavioral task

behavioral11

Sample

24989d884f480964f0cfd5d5ed0cf785b6b97843779051ab12c6c17beabb15b7.exe

Resource

win7-20240704-en

danabot 4 banker discovery trojan

windows7-x64

6 signatures

150 seconds

Behavioral task

behavioral12

Sample

24989d884f480964f0cfd5d5ed0cf785b6b97843779051ab12c6c17beabb15b7.exe

Resource

win10v2004-20240802-en

danabot 4 banker discovery trojan

windows10-2004-x64

7 signatures

150 seconds

Behavioral task

behavioral13

Sample

2828fabf3937d88b85183664c9019c4639776ba7c2322f48e4957108ef07ed65.dll

Resource

win7-20240704-en

windows7-x64

0 signatures

150 seconds

Behavioral task

behavioral14

Sample

2828fabf3937d88b85183664c9019c4639776ba7c2322f48e4957108ef07ed65.dll

Resource

win10v2004-20240802-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral15

Sample

32b0fbaf95fefcc9b89243be8721625592fc9ed92d76a48cab263898fd3d5c08.exe

Resource

win7-20240729-en

djvu discovery persistence ransomware

windows7-x64

11 signatures

150 seconds

Behavioral task

behavioral16

Sample

32b0fbaf95fefcc9b89243be8721625592fc9ed92d76a48cab263898fd3d5c08.exe

Resource

win10v2004-20240802-en

djvu discovery persistence ransomware

windows10-2004-x64

13 signatures

150 seconds

Behavioral task

behavioral17

Sample

4bf2dace8a23551a3cd374a14b68cef6185aa18f9148dac8bf77f19f734d3ad7.exe

Resource

win7-20240705-en

djvu discovery persistence ransomware

windows7-x64

10 signatures

150 seconds

Behavioral task

behavioral18

Sample

4bf2dace8a23551a3cd374a14b68cef6185aa18f9148dac8bf77f19f734d3ad7.exe

Resource

win10v2004-20240802-en

djvu discovery persistence ransomware

windows10-2004-x64

12 signatures

150 seconds

Behavioral task

behavioral19

Sample

55d03f9954e35d8bce3fbd084d909744b3719310bac7c359cda87e7831cc1344.dll

Resource

win7-20240708-en

icedid 1677747888 banker loader trojan

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral20

Sample

55d03f9954e35d8bce3fbd084d909744b3719310bac7c359cda87e7831cc1344.dll

Resource

win10v2004-20240802-en

icedid 1677747888 banker loader trojan

windows10-2004-x64

2 signatures

150 seconds

Behavioral task

behavioral21

Sample

5e58e3818a1b7a5c46fab0a1400f7ccd88f088a782bb9c9f229f5e835e57aecb.exe

Resource

win7-20240705-en

lokibot collection credential_access discovery spyware stealer trojan

windows7-x64

12 signatures

150 seconds

Behavioral task

behavioral22

Sample

5e58e3818a1b7a5c46fab0a1400f7ccd88f088a782bb9c9f229f5e835e57aecb.exe

Resource

win10v2004-20240802-en

lokibot collection credential_access discovery spyware stealer trojan

windows10-2004-x64

13 signatures

150 seconds

Behavioral task

behavioral23

Sample

611cf2be6752c173be1328ea47cc8ea736bc3bda9030da617390b23afa955b47.exe

Resource

win7-20240704-en

stormkitty credential_access discovery persistence privilege_escalation spyware stealer

windows7-x64

16 signatures

150 seconds

Behavioral task

behavioral24

Sample

611cf2be6752c173be1328ea47cc8ea736bc3bda9030da617390b23afa955b47.exe

Resource

win10v2004-20240802-en

stormkitty credential_access discovery persistence privilege_escalation spyware stealer

windows10-2004-x64

16 signatures

150 seconds

Behavioral task

behavioral25

Sample

654e574fb479af0a9f8d277ed12f2d86681b76b4cfe63d7c9e774f5144be8801.exe

Resource

win7-20240708-en

discovery

windows7-x64

1 signatures

150 seconds

Behavioral task

behavioral26

Sample

654e574fb479af0a9f8d277ed12f2d86681b76b4cfe63d7c9e774f5144be8801.exe

Resource

win10v2004-20240802-en

discovery

windows10-2004-x64

1 signatures

150 seconds

Behavioral task

behavioral27

Sample

6f4ac0da343abb9dd25d7a27c302a6ab29ed9e7c49123b3c8200138abd3eaea5.exe

Resource

win7-20240708-en

discovery evasion themida trojan

windows7-x64

17 signatures

150 seconds

Behavioral task

behavioral28

Sample

6f4ac0da343abb9dd25d7a27c302a6ab29ed9e7c49123b3c8200138abd3eaea5.exe

Resource

win10v2004-20240802-en

discovery evasion themida trojan

windows10-2004-x64

19 signatures

150 seconds

Behavioral task

behavioral29

Sample

$PLUGINSDIR/System.dll

Resource

win7-20240708-en

discovery

windows7-x64

3 signatures

150 seconds

Behavioral task

behavioral30

Sample

$PLUGINSDIR/System.dll

Resource

win10v2004-20240802-en

discovery

windows10-2004-x64

3 signatures

150 seconds

Behavioral task

behavioral31

Sample

$PLUGINSDIR/nsDialogs.dll

Resource

win7-20240708-en

discovery

windows7-x64

3 signatures

150 seconds

Behavioral task

behavioral32

Sample

$PLUGINSDIR/nsDialogs.dll

Resource

win10v2004-20240802-en

discovery

windows10-2004-x64

3 signatures

150 seconds

Report Analysis Logs

General

Target

1df11bc19aa52b623bdf15380e3fded56d8eb6fb7b53a2240779864b1a6474ad.exe
Size

1.3MB
MD5

9344afc63753cd5e2ee0ff9aed43dc56
SHA1

ee1fa399ace734c33b77c62b6fb010219580448f
SHA256

1df11bc19aa52b623bdf15380e3fded56d8eb6fb7b53a2240779864b1a6474ad
SHA512

6434c212a85180c1af00f5c5fa081a6a6ab66f5633edb74e130a7b9d754a6a65dc973f5e820f6f57a43956c276dbf3721021d1e9bb53fa79ac51ed8cb23f4090
SSDEEP

24576:/U1v3pE+zO9mBt2bdm3EHVXkNA80Jl5IzCxWWDrSBkian7X5:/Qv74bdm3EHEA8UIzm8aj5

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral7/memory/2880-0-0x0000000000030000-0x00000000004AA000-memory.dmp	upx
behavioral7/memory/2880-2-0x0000000000030000-0x00000000004AA000-memory.dmp	upx

Processes

C:\Users\Admin\AppData\Local\Temp\1df11bc19aa52b623bdf15380e3fded56d8eb6fb7b53a2240779864b1a6474ad.exe
"C:\Users\Admin\AppData\Local\Temp\1df11bc19aa52b623bdf15380e3fded56d8eb6fb7b53a2240779864b1a6474ad.exe"
1⤵
PID:2880

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2880-0-0x0000000000030000-0x00000000004AA000-memory.dmp

Filesize
4.5MB

Download
memory/2880-2-0x0000000000030000-0x00000000004AA000-memory.dmp

Filesize
4.5MB

Download