Overview

overview

8

Static

static

15e9c2b3b3...d2.exe

windows7_x64

8

15e9c2b3b3...d2.exe

windows10-2004_x64

8

Analysis

  • max time kernel
    122s
  • max time network
    137s
  • platform
    windows7_x64
  • resource
    win7-en-20211208
  • submitted
    07-03-2022 10:31

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    15e9c2b3b351c613e945a937776b63b007be9c24f3999eb91813cb9ed32178d2.exe

  • Size

    987KB

  • MD5

    8a09ec6492f6568e0df78f35389d330a

  • SHA1

    434a3a2f61f21efc7f5fc3bb9439a174f91b996a

  • SHA256

    15e9c2b3b351c613e945a937776b63b007be9c24f3999eb91813cb9ed32178d2

  • SHA512

    45aaf075273f3d377a5ff4614d6e12cf276614cd2d635253cf6cfe5f8fea01cf54893e1cc6bf0b13f311d5c70bb96941cbba7c06740d1bec1de7593ae46fa07e

Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\15e9c2b3b351c613e945a937776b63b007be9c24f3999eb91813cb9ed32178d2.exe
    "C:\Users\Admin\AppData\Local\Temp\15e9c2b3b351c613e945a937776b63b007be9c24f3999eb91813cb9ed32178d2.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1204
    • C:\Users\Admin\AppData\Local\Temp\is-G2SQC.tmp\15e9c2b3b351c613e945a937776b63b007be9c24f3999eb91813cb9ed32178d2.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-G2SQC.tmp\15e9c2b3b351c613e945a937776b63b007be9c24f3999eb91813cb9ed32178d2.tmp" /SL5="$C014E,759200,121344,C:\Users\Admin\AppData\Local\Temp\15e9c2b3b351c613e945a937776b63b007be9c24f3999eb91813cb9ed32178d2.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: GetForegroundWindowSpam
      PID:1716

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\is-G2SQC.tmp\15e9c2b3b351c613e945a937776b63b007be9c24f3999eb91813cb9ed32178d2.tmp
    MD5

    1a8ac942e4c2302d349caaed9943360d

    SHA1

    a08ce743c3d90a2b713db3e58e747e7a00a32590

    SHA256

    db8341fc8e86f7b80fbe144aa9ceea3e3369b64dcd5998c5a7f186c304cfeb96

    SHA512

    d65e4f9846bb6fba5a8b4f9409b2576af041dfa9b453800c298ec810bd27cfcf28d1933bc79893aa79323654ab4b85e321b03eaf17d67f0e19c79749751e4aab

    Download Submit
  • \Users\Admin\AppData\Local\Temp\is-G2SQC.tmp\15e9c2b3b351c613e945a937776b63b007be9c24f3999eb91813cb9ed32178d2.tmp
    MD5

    1a8ac942e4c2302d349caaed9943360d

    SHA1

    a08ce743c3d90a2b713db3e58e747e7a00a32590

    SHA256

    db8341fc8e86f7b80fbe144aa9ceea3e3369b64dcd5998c5a7f186c304cfeb96

    SHA512

    d65e4f9846bb6fba5a8b4f9409b2576af041dfa9b453800c298ec810bd27cfcf28d1933bc79893aa79323654ab4b85e321b03eaf17d67f0e19c79749751e4aab

    Download Submit
  • memory/1204-55-0x0000000075831000-0x0000000075833000-memory.dmp
    Filesize

    8KB

    Download
  • memory/1204-56-0x0000000000400000-0x0000000000425000-memory.dmp
    Filesize

    148KB

    Download
  • memory/1204-58-0x0000000000400000-0x0000000000425000-memory.dmp
    Filesize

    148KB

    Download
  • memory/1716-62-0x0000000000240000-0x0000000000241000-memory.dmp
    Filesize

    4KB

    Download