128da107c20b7de63ac575bdbc4f87df5ba5283a710e26d2864ae98985b5356f

Analysis

max time kernel
122s
max time network
128s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
11/09/2024, 20:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

main.exe
Size

25.3MB
MD5

855455de8ab36382208304709166882a
SHA1

b6679212cee2a18963c21ee3380c9cf9b4e99d6c
SHA256

128da107c20b7de63ac575bdbc4f87df5ba5283a710e26d2864ae98985b5356f
SHA512

56e8f900350388158dab4c5c93183ae4dff78a0c77e1817420f794407531ac99fe831acc647584b8eccc90e491a784c25d2d9d518cc32f4beb5c3c7fc5c0a06c
SSDEEP

786432:fPLFXs7dzrv03GYPQttaSa8o5VLTdGjRp:HLFcxs2YPQZHSLsp

Score

7^/10

upx

Malware Config

Signatures

Loads dropped DLL 7 IoCs

pid	Process
1908	main.exe
1908	main.exe
1908	main.exe
1908	main.exe
1908	main.exe
1908	main.exe
1908	main.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0004000000019715-213.dat	upx
behavioral1/memory/1908-215-0x000007FEF6A10000-0x000007FEF6E76000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2656 wrote to memory of 1908	2656	main.exe	30
PID 2656 wrote to memory of 1908	2656	main.exe	30
PID 2656 wrote to memory of 1908	2656	main.exe	30

C:\Users\Admin\AppData\Local\Temp\main.exe
"C:\Users\Admin\AppData\Local\Temp\main.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2656
- C:\Users\Admin\AppData\Local\Temp\main.exe
  "C:\Users\Admin\AppData\Local\Temp\main.exe"
  2⤵
  - Loads dropped DLL
  PID:1908

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_MEI26562\api-ms-win-core-file-l1-2-0.dll

Filesize
13KB

MD5
6b280015cf873517051ccbda728dea4b

SHA1
c83f9bc0e27eb1969559d6aeaa268c99a5a4dde1

SHA256
f2a0d0fc3d24e72f3cc46111d7166ab8a4511674b73617d2019f235c61b30654

SHA512
fcb108b3a95d13059434415c3d054669b4741c85f4a21dc60f69af870a306aa6c2726b03e746f9ad5ff916cfc23a1bc1ed541e635b4720e430b334e921e568e1

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI26562\api-ms-win-core-file-l2-1-0.dll

Filesize
13KB

MD5
37fcc989b5ae55d0d18ee69edf57f6c6

SHA1
c4b2cdc1aee7137fbe4993b03859e9fb45fc3e14

SHA256
4047ec069444b0b466c4b375bd55aa1e1b6c177bda61eca391969b3d0d07f534

SHA512
bcbf7c4bd709ab1b7fbac483bf2b002abaac93e7e74ec465c31ab9ece6cd7874ffeced5a998302514e3f0cf15e571c09d7197d146f6fe490dbf429ea2a964d4c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI26562\api-ms-win-core-localization-l1-2-0.dll

Filesize
15KB

MD5
d48de46dc141d9cad89cd97a9ac326da

SHA1
6ae6491924a7ea716f907490cf1851da014ee3c5

SHA256
aaacc72a5e85ceb15181b4604683543f81b37dd1d5215d647ff3fb464935f890

SHA512
6bcd7f62c293f8a3aea9937c4520851babd8ed796b138860e3e3aac7bb95715b5987485f8ee8255209bbb704e73e833d4cddf1c8e57bd2a39448dc292bb4f6ce

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI26562\api-ms-win-core-processthreads-l1-1-1.dll

Filesize
13KB

MD5
d23eb2dbfb3094b4bd37cb304f6c2a8d

SHA1
9f2ed84b2a8d46bd8ca0704917e95a44c3426ef3

SHA256
af4d0083bac90404962e846a91385fc10b62dc739d1a763ec11950636a62a1f3

SHA512
d1cfbcdb9f97958593c561c3e7bdf6da7fe1ab586592c74bff7dd5cf1296fb2f5f7139ebeebe55bf4ae62c4043819955fc6764a6e724e00e9bbdb77d52d8f7b6

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI26562\api-ms-win-core-timezone-l1-1-0.dll

Filesize
13KB

MD5
a9b11e4a24f3dfd567f79e1fca5375d2

SHA1
90a76ed33255c1db551fe95debbefdf07d3617a3

SHA256
df91a750aad544f3c1048d2b397890aa91282e115652ac833639196f8e945a3d

SHA512
2fc0163d74fb121d4d426b99ba70c65a1f847c9b867fad0f86e9caa7b295e101958b2bf05a8b2498fbe0027cad71ea8c09ece3e5d2c4d707936e42c21f840236

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI26562\pyinstaller-5.1.dist-info\INSTALLER

Filesize
4B

MD5
365c9bfeb7d89244f2ce01c1de44cb85

SHA1
d7a03141d5d6b1e88b6b59ef08b6681df212c599

SHA256
ceebae7b8927a3227e5303cf5e0f1f7b34bb542ad7250ac03fbcde36ec2f1508

SHA512
d220d322a4053d84130567d626a9f7bb2fb8f0b854da1621f001826dc61b0ed6d3f91793627e6f0ac2ac27aea2b986b6a7a63427f05fe004d8a2adfbdadc13c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI26562\python310.dll

Filesize
1.4MB

MD5
d2db855332efd27f90bdc40139248fef

SHA1
0c855c2e897c4f3b823d4e0152ec8d82d05d4b37

SHA256
c2fb35fc301842b9258c90c68ec1c77fee87e3b6b811dfb53a80573115696478

SHA512
d3df6fcb9c08ef9d31695893587e37e82af9f9fb931463cea2b1ef26685646f2eaf660f743d3bdc57d82491e1edffb6ead1b3175632bd2d28f35784bb15da4f7

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI26562\ucrtbase.dll

Filesize
987KB

MD5
907116582b20dab2c7952d283b2859e0

SHA1
92ed93d90e3dbed0bede26684618cdf40824f3f7

SHA256
aaada1f31f5862c7f7ebd68b15a4b854465d9e0c525228632ab6c85c2f321acb

SHA512
eb468b1537c299ddb486d6b8ebf4edf5821458bd012400b995c4c2d351aee67e5e292f5828baef07cc52a8c57940cb0d7cda7a99ef83e21978818fd28a7e4bc4

Download Submit
memory/1908-215-0x000007FEF6A10000-0x000007FEF6E76000-memory.dmp

Filesize
4.4MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads