Resubmissions
17-01-2021 19:18
210117-5hwxlye88x 1017-01-2021 17:05
210117-6jkt8jz44e 1017-01-2021 10:25
210117-ncy8vksfgn 10Analysis
-
max time kernel
14s -
max time network
124s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
17-01-2021 19:18
General
-
Target
3842928b05f44dcd7d813c2f5c53c86b032ef689983f287f7c4edb4bab2a096a.exe
-
Size
883KB
-
MD5
e9e137a635eccb83d460c9c583930a00
-
SHA1
22271f2f3e5632032d91ab0fdbce40bbd7d02126
-
SHA256
3842928b05f44dcd7d813c2f5c53c86b032ef689983f287f7c4edb4bab2a096a
-
SHA512
ad3b8000b6d7db2d327e9be3f4a4d369306c1aea96d2113465e77fb6e24e446dd545e9b2065f91a3961f23996e46f77d5d52f7a1ea8329c983a52897a6e01355
Score
8/10
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Deletes itself 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\3842928b05f44dcd7d813c2f5c53c86b032ef689983f287f7c4edb4bab2a096a.exe"C:\Users\Admin\AppData\Local\Temp\3842928b05f44dcd7d813c2f5c53c86b032ef689983f287f7c4edb4bab2a096a.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3842928b05f44dcd7d813c2f5c53c86b032ef689983f287f7c4edb4bab2a096a.exeC:\Users\Admin\AppData\Local\Temp\3842928b05f44dcd7d813c2f5c53c86b032ef689983f287f7c4edb4bab2a096a.exe2⤵
- Executes dropped EXE
- Deletes itself
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
652KB
-
Filesize
8KB
-
Filesize
912KB
-
Filesize
4KB
-
Filesize
180KB
-
Filesize
652KB
-
Filesize
2.5MB