c41899315b2f3dad512ed1f58746e59fdb2f9717badcf7b2c861c1248d945991

Submit
Reports

Overview

overview

Static

static

D02D012970...94.exe

windows7-x64

D02D012970...94.exe

windows10-2004-x64

DBm0yQwt.exe.ViR.exe

windows7-x64

DBm0yQwt.exe.ViR.exe

windows10-2004-x64

ca6ec46ee9...52.apk

android-9-x86

ca6ec46ee9...52.apk

android-10-x64

ca6ec46ee9...52.apk

android-11-x64

calc.exe

windows10-2004-x64

ccc71c83c8...B3.exe

windows7-x64

ccc71c83c8...B3.exe

windows10-2004-x64

ccc71c83c8...68.exe

windows7-x64

ccc71c83c8...68.exe

windows10-2004-x64

cd2d085998...-0.dll

windows7-x64

cd2d085998...-0.dll

windows10-2004-x64

cdffb7e75b...ss.exe

windows7-x64

cdffb7e75b...ss.exe

windows10-2004-x64

cf7382c25a...c9.exe

windows7-x64

cf7382c25a...c9.exe

windows10-2004-x64

cgi19-alpt...e_.exe

windows7-x64

cgi19-alpt...e_.exe

windows10-2004-x64

chrst.exe

windows7-x64

chrst.exe

windows10-2004-x64

ci05l2a.exe

windows7-x64

ci05l2a.exe

windows10-2004-x64

cl.exe

windows7-x64

cl.exe

windows10-2004-x64

clean.exe

windows7-x64

clean.exe

windows10-2004-x64

coinvault.exe

windows7-x64

coinvault.exe

windows10-2004-x64

com_loader.exe

windows7-x64

com_loader.exe

windows10-2004-x64

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
22-11-2024 03:41

Sharing

Copy URL

Twitter E-mail

Static task

static1

upx

4 signatures

Behavioral task

behavioral1

Sample

D02D012970AA164CAD15C757D7E52994.exe

Resource

win7-20240903-en

windows7-x64

1 signatures

150 seconds

Behavioral task

behavioral2

Sample

D02D012970AA164CAD15C757D7E52994.exe

Resource

win10v2004-20241007-en

windows10-2004-x64

1 signatures

150 seconds

Behavioral task

behavioral3

Sample

DBm0yQwt.exe.ViR.exe

Resource

win7-20241010-en

defense_evasion discovery execution impact ransomware

windows7-x64

21 signatures

150 seconds

Behavioral task

behavioral4

Sample

DBm0yQwt.exe.ViR.exe

Resource

win10v2004-20241007-en

discovery ransomware

windows10-2004-x64

16 signatures

150 seconds

Behavioral task

behavioral5

Sample

ca6ec46ee9435a4745fd3a03267f051dc64540dd348f127bb33e9675dadd3d52.apk

Resource

android-x86-arm-20240624-en

evasion persistence stealth trojan

android-9-x86

2 signatures

150 seconds

Behavioral task

behavioral6

Sample

ca6ec46ee9435a4745fd3a03267f051dc64540dd348f127bb33e9675dadd3d52.apk

Resource

android-x64-20240624-en

evasion persistence stealth trojan

android-10-x64

2 signatures

150 seconds

Behavioral task

behavioral7

Sample

ca6ec46ee9435a4745fd3a03267f051dc64540dd348f127bb33e9675dadd3d52.apk

Resource

android-x64-arm64-20240624-en

evasion persistence stealth trojan

android-11-x64

2 signatures

150 seconds

Behavioral task

behavioral8

Sample

calc.exe

Resource

win10v2004-20241007-en

upx

windows10-2004-x64

1 signatures

150 seconds

Behavioral task

behavioral9

Sample

ccc71c83c8d9895ef0b375273f9f185dfac63ecd01775e2dc705afe4d48c95e2_Dumped_TDS=4F9911B3.exe

Resource

win7-20241010-en

persistence

windows7-x64

3 signatures

150 seconds

Behavioral task

behavioral10

Sample

ccc71c83c8d9895ef0b375273f9f185dfac63ecd01775e2dc705afe4d48c95e2_Dumped_TDS=4F9911B3.exe

Resource

win10v2004-20241007-en

discovery persistence

windows10-2004-x64

5 signatures

150 seconds

Behavioral task

behavioral11

Sample

ccc71c83c8d9895ef0b375273f9f185dfac63ecd01775e2dc705afe4d48c95e2_TDS=4FAD9768.exe

Resource

win7-20240903-en

discovery persistence

windows7-x64

4 signatures

150 seconds

Behavioral task

behavioral12

Sample

ccc71c83c8d9895ef0b375273f9f185dfac63ecd01775e2dc705afe4d48c95e2_TDS=4FAD9768.exe

Resource

win10v2004-20241007-en

discovery

windows10-2004-x64

2 signatures

150 seconds

Behavioral task

behavioral13

Sample

cd2d085998a289134ffaf27fbdcbc8cb_api-ms-win-system-dispex-l1-1-0.dll

Resource

win7-20240903-en

discovery spyware stealer

windows7-x64

9 signatures

150 seconds

Behavioral task

behavioral14

Sample

cd2d085998a289134ffaf27fbdcbc8cb_api-ms-win-system-dispex-l1-1-0.dll

Resource

win10v2004-20241007-en

discovery spyware stealer

windows10-2004-x64

9 signatures

150 seconds

Behavioral task

behavioral15

Sample

cdffb7e75b20eeae4db75c9962c17b3be980a719f7597e8b11a747d72c975a36_not_packed_maybe_useless.exe

Resource

win7-20240903-en

discovery

windows7-x64

3 signatures

150 seconds

Behavioral task

behavioral16

Sample

cdffb7e75b20eeae4db75c9962c17b3be980a719f7597e8b11a747d72c975a36_not_packed_maybe_useless.exe

Resource

win10v2004-20241007-en

discovery

windows10-2004-x64

2 signatures

150 seconds

Behavioral task

behavioral17

Sample

cf7382c25a8bf0d904d51063ceb29fb70f630bc9.exe

Resource

win7-20241023-en

discovery persistence

windows7-x64

6 signatures

150 seconds

Behavioral task

behavioral18

Sample

cf7382c25a8bf0d904d51063ceb29fb70f630bc9.exe

Resource

win10v2004-20241007-en

discovery

windows10-2004-x64

2 signatures

150 seconds

Behavioral task

behavioral19

Sample

cgi19-alptsevs-h555.exe_.exe

Resource

win7-20240708-en

bootkit discovery persistence spyware stealer

windows7-x64

20 signatures

150 seconds

Behavioral task

behavioral20

Sample

cgi19-alptsevs-h555.exe_.exe

Resource

win10v2004-20241007-en

bootkit discovery persistence

windows10-2004-x64

17 signatures

150 seconds

Behavioral task

behavioral21

Sample

chrst.exe

Resource

win7-20240903-en

discovery

windows7-x64

3 signatures

150 seconds

Behavioral task

behavioral22

Sample

chrst.exe

Resource

win10v2004-20241007-en

discovery

windows10-2004-x64

3 signatures

150 seconds

Behavioral task

behavioral23

Sample

ci05l2a.exe

Resource

win7-20241010-en

windows7-x64

0 signatures

150 seconds

Behavioral task

behavioral24

Sample

ci05l2a.exe

Resource

win10v2004-20241007-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral25

Sample

cl.exe

Resource

win7-20241010-en

discovery persistence

windows7-x64

7 signatures

150 seconds

Behavioral task

behavioral26

Sample

cl.exe

Resource

win10v2004-20241007-en

discovery persistence

windows10-2004-x64

5 signatures

150 seconds

Behavioral task

behavioral27

Sample

clean.exe

Resource

win7-20240903-en

discovery

windows7-x64

1 signatures

150 seconds

Behavioral task

behavioral28

Sample

clean.exe

Resource

win10v2004-20241007-en

discovery

windows10-2004-x64

1 signatures

150 seconds

Behavioral task

behavioral29

Sample

coinvault.exe

Resource

win7-20240903-en

defense_evasion discovery execution impact persistence ransomware

windows7-x64

9 signatures

150 seconds

Behavioral task

behavioral30

Sample

coinvault.exe

Resource

win10v2004-20241007-en

discovery persistence

windows10-2004-x64

7 signatures

150 seconds

Behavioral task

behavioral31

Sample

com_loader.exe

Resource

win7-20241023-en

discovery

windows7-x64

3 signatures

150 seconds

Behavioral task

behavioral32

Sample

com_loader.exe

Resource

win10v2004-20241007-en

discovery

windows10-2004-x64

3 signatures

150 seconds

Report Analysis Logs

General

Target

calc.exe
Size

161KB
MD5

df543c8c85a47c41886f644f4ecf66ff
SHA1

460154b09e361829c46efcbd64848bfd1db43f53
SHA256

ef00fed6e97e926bdb3b968030795ef5dd34e8e40dec2b7cf802de97feed6321
SHA512

2a43d36b8db163de66c48d3e1db318d4ffc4aa52f2bb5e3b5074cd597cedd18be5f01b07d1afe7cb53af54c54d4e3e32e0bd0c27d2f8698459c1214b5ebfc17d
SSDEEP

3072:g4eqa10YgyW9nnrS8zut754EmUQqWKcm+cqAdZuRqoDb1Ndgjx9MApVfqF8CHJq:A5WFrbzSeE6qWK+yHuR/DfCt9vpAFrp

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral8/memory/1404-2-0x0000000000400000-0x0000000000437000-memory.dmp	upx
behavioral8/memory/1404-0-0x0000000000400000-0x0000000000437000-memory.dmp	upx

Processes

C:\Users\Admin\AppData\Local\Temp\calc.exe
"C:\Users\Admin\AppData\Local\Temp\calc.exe"
1⤵
PID:1404

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1404-2-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/1404-0-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download