9968a98c223ddd2825ac2c43a6a54de556880c2dbcd704bc5b14c1927e9ce0cc

Resubmissions

15-01-2025 13:20

250115-qlft7stmhy 10

15-01-2025 13:04

250115-qa75batket 10

15-01-2025 12:47

250115-p1fx3svkhp 10

Analysis

max time kernel
837s
max time network
838s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
15-01-2025 13:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

vanish (1).exe
Size

7.5MB
MD5

3a15cfe7fce7dbae2bbd7e2dfa9c8e92
SHA1

636288fb385e5a7aef9ae4c5dec176cf65f5f110
SHA256

9968a98c223ddd2825ac2c43a6a54de556880c2dbcd704bc5b14c1927e9ce0cc
SHA512

34d9b66c918f4d5356ecd4d4a4fe09cce682899f703569cecc531f6f519f6f3830e9c8b8b45e44f3efe36c6110cbe98401e5dce79150977093a445776caafe1f
SSDEEP

196608:X2gFm6wfI9jUC2gYBYv3vbWY+iITm1U6fd1Ek:vFiIH2gYBgDW/TOzbD

Score

7^/10

upx

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
2684	vanish (1).exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0005000000019d2d-21.dat	upx

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2684	vanish (1).exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2112 wrote to memory of 2684	2112	vanish (1).exe	30
PID 2112 wrote to memory of 2684	2112	vanish (1).exe	30
PID 2112 wrote to memory of 2684	2112	vanish (1).exe	30

C:\Users\Admin\AppData\Local\Temp\vanish (1).exe
"C:\Users\Admin\AppData\Local\Temp\vanish (1).exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2112
- C:\Users\Admin\AppData\Local\Temp\vanish (1).exe
  "C:\Users\Admin\AppData\Local\Temp\vanish (1).exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: GetForegroundWindowSpam
  PID:2684

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_MEI21122\python312.dll

Filesize
1.7MB

MD5
6f7c42579f6c2b45fe866747127aef09

SHA1
b9487372fe3ed61022e52cc8dbd37e6640e87723

SHA256
07642b6a3d99ce88cff790087ac4e2ba0b2da1100cf1897f36e096427b580ee5

SHA512
aadf06fd6b4e14f600b0a614001b8c31e42d71801adec7c9c177dcbb4956e27617fa45ba477260a7e06d2ca4979ed5acc60311258427ee085e8025b61452acec

Download Submit
memory/2684-23-0x000007FEF5A70000-0x000007FEF6135000-memory.dmp

Filesize
6.8MB

Download
memory/2684-24-0x000007FEF5A70000-0x000007FEF6135000-memory.dmp

Filesize
6.8MB

Download