Overview

overview

10

Static

static

10

testing do...!!.exe

windows7-x64

7

testing do...!!.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    120s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240729-en
  • resource tags

    arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
  • submitted
    10-08-2024 05:58

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    testing dont reverse please!!.exe

  • Size

    81.6MB

  • MD5

    2d3589207c2e3381ed6fc424458c3004

  • SHA1

    27ad41efee4e0ab12cf50942fca51c15a269a292

  • SHA256

    4eaa607247cae4f1f4e29e7cbfd04b37824ee6392a88d237fbe6d04279f9ea1b

  • SHA512

    26d8618cd4e32d27aebc2c85f60cc04d99b78a4c5cde7eec0440fbf9bcd8a7cfcfcf8007f1bed256f7852cb611dc253679ac8ff58346cf6253f703c5e504c6e8

  • SSDEEP

    1572864:HvxZQglXPu7vnSk8IpG7V+VPhqb+TWE7Ulg8iYgj+h58sMw5IlWK9nY3cJX0:HvxZxRmLSkB05awb+TMe25FSj9nz0

Score
7/10
upx

Malware Config

Signatures

  • Loads dropped DLL 7 IoCs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\testing dont reverse please!!.exe
    "C:\Users\Admin\AppData\Local\Temp\testing dont reverse please!!.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2764
    • C:\Users\Admin\AppData\Local\Temp\testing dont reverse please!!.exe
      "C:\Users\Admin\AppData\Local\Temp\testing dont reverse please!!.exe"
      2⤵
      • Loads dropped DLL
      PID:292

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\_MEI27642\api-ms-win-core-file-l1-2-0.dll
    Filesize

    21KB

    MD5

    3473bc217562594b5b126d7aeb9380e9

    SHA1

    b551b9d9aa80be070f577376e484610e01c5171a

    SHA256

    0d8190fd619feb20df123931108d499132f7051f1ebb0ef246082f4c52c88b22

    SHA512

    036b93457ade632ad68264d81ff26ee1156038e234c606882386d6babcbe722a18e9ced1655f97caecaf5fd514e261dafe999a3e9fec00cc677e177f0bf8e203

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI27642\api-ms-win-core-file-l2-1-0.dll
    Filesize

    20KB

    MD5

    50abf0a7ee67f00f247bada185a7661c

    SHA1

    0cddac9ac4db3bf10a11d4b79085ef9cb3fb84a1

    SHA256

    f957a4c261506484b53534a9be8931c02ec1a349b3f431a858f8215cecfec3f7

    SHA512

    c2694bb5d103baff1264926a04d2f0fe156b8815a23c3748412a81cc307b71a9236a0e974b5549321014065e393d10228a0f0004df9ba677f03b5d244a64b528

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI27642\api-ms-win-core-localization-l1-2-0.dll
    Filesize

    21KB

    MD5

    0414909b279ea61ca344edbe8e33e40b

    SHA1

    4ece0dabe954c43f9bd5032de76ec29c47b22e10

    SHA256

    05b0c773a77850f3d50ddb4b82cc4d5f19316fe1aaa65e21b4709ae73f60a28e

    SHA512

    edbd33540cd1ef69f2ce824cfb991903ec6e4edda815f07d610247594ceeb2ebc78f05a44b4de8c5c937191b7e8b2ef221423c06df303d73deea721c25d15eed

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI27642\api-ms-win-core-processthreads-l1-1-1.dll
    Filesize

    21KB

    MD5

    b1ba47d8389c40c2dda3c56cbed14fc5

    SHA1

    2eef9ffa32171d53affa44e3db7727aa383f7fac

    SHA256

    c7277c05dc6b905fad5cb930b0ecfbbc4676b46974b4571e54ca44cb6f6be404

    SHA512

    466e31f17f73bda5149343b23f4966502a8597d2a2e43f9a6c9c32387451d92c6b658ccaae27044e68e4a9fd0ef9c89e32dc7639d59fcf04c596b6abfa09658b

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI27642\api-ms-win-core-timezone-l1-1-0.dll
    Filesize

    21KB

    MD5

    953c63ef10ec30ef7c89a6f0f7074041

    SHA1

    4b4f1ff3085fded9dbd737f273585ad43175b0a3

    SHA256

    c93954167c12e15b58ac95240d2e0a2fbd94561d739d9f6aca906d9c30453496

    SHA512

    b4534785e4d02ad387e3c6082884d438cc4b3cd8758aabcf99620052f5842dbd298351bc1723c274d4f7d3fce0cc940df3d47865fece2f07cdb1151376ba852e

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI27642\python311.dll
    Filesize

    1.6MB

    MD5

    8ea69ca2292c3af9cdb46dded91bc837

    SHA1

    72de7df68b2c336720d1528c34f21ff00ed7a2ce

    SHA256

    3512c3a7ad74af034f51eba397c0e4716f592861ea3030745e8fd4dc8f9bca49

    SHA512

    fb317bab11c922dc183d834b770e37e382b9cf3ab1ea95e9bca8d73ed1e23cc9ef2b6aea4a20d4637eba34276c81a6eee54b00cb146f825ef554d81387ae4ddc

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI27642\ucrtbase.dll
    Filesize

    1.1MB

    MD5

    3b337c2d41069b0a1e43e30f891c3813

    SHA1

    ebee2827b5cb153cbbb51c9718da1549fa80fc5c

    SHA256

    c04daeba7e7c4b711d33993ab4c51a2e087f98f4211aea0dcb3a216656ba0ab7

    SHA512

    fdb3012a71221447b35757ed2bdca6ed1f8833b2f81d03aabebd2cd7780a33a9c3d816535d03c5c3edd5aaf11d91156842b380e2a63135e3c7f87193ad211499

    Download Submit

  • memory/292-1316-0x000007FEF5CC0000-0x000007FEF62A9000-memory.dmp

    Filesize

    5.9MB

    Download