Overview

overview

10

Static

static

4797508E2-...8G.exe

windows7_x64

1

4797508E2-...8G.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    151s
  • max time network
    52s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    02-05-2022 15:11

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    4797508E2-20F2-4C2C-879A-1C358G.exe

  • Size

    652KB

  • MD5

    696f1e6e8b7f8ed2b20e9aa689be7333

  • SHA1

    62cb835dc20ef745186fd3805c230b96c1177ba2

  • SHA256

    ce0e9c38f501c41244755438857cf76ab25727502b344c65d30075ff3338f43c

  • SHA512

    2971d105982aecea405c1c632953dad58bfd4fe32450d4d8c7e7cfde9ad2fde6af5acb113447a3322d0fe8b6171f471ef8b44cebedd621666210f0dd9741fe52

Score
1/10

Malware Config

Signatures

  • Suspicious behavior: MapViewOfSection 12 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4797508E2-20F2-4C2C-879A-1C358G.exe
    "C:\Users\Admin\AppData\Local\Temp\4797508E2-20F2-4C2C-879A-1C358G.exe"
    1⤵
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of WriteProcessMemory
    PID:1628
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
      2⤵
        PID:1948
      • C:\Users\Admin\AppData\Local\Temp\4797508E2-20F2-4C2C-879A-1C358G.exe
        "C:\Users\Admin\AppData\Local\Temp\4797508E2-20F2-4C2C-879A-1C358G.exe"
        2⤵
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of WriteProcessMemory
        PID:1956
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
          3⤵
            PID:1228
          • C:\Users\Admin\AppData\Local\Temp\4797508E2-20F2-4C2C-879A-1C358G.exe
            "C:\Users\Admin\AppData\Local\Temp\4797508E2-20F2-4C2C-879A-1C358G.exe"
            3⤵
            • Suspicious behavior: MapViewOfSection
            • Suspicious use of WriteProcessMemory
            PID:1268
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
              4⤵
                PID:952
              • C:\Users\Admin\AppData\Local\Temp\4797508E2-20F2-4C2C-879A-1C358G.exe
                "C:\Users\Admin\AppData\Local\Temp\4797508E2-20F2-4C2C-879A-1C358G.exe"
                4⤵
                • Suspicious behavior: MapViewOfSection
                • Suspicious use of WriteProcessMemory
                PID:1252
                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                  5⤵
                    PID:2032
                  • C:\Users\Admin\AppData\Local\Temp\4797508E2-20F2-4C2C-879A-1C358G.exe
                    "C:\Users\Admin\AppData\Local\Temp\4797508E2-20F2-4C2C-879A-1C358G.exe"
                    5⤵
                    • Suspicious behavior: MapViewOfSection
                    • Suspicious use of WriteProcessMemory
                    PID:2044
                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                      6⤵
                        PID:1700
                      • C:\Users\Admin\AppData\Local\Temp\4797508E2-20F2-4C2C-879A-1C358G.exe
                        "C:\Users\Admin\AppData\Local\Temp\4797508E2-20F2-4C2C-879A-1C358G.exe"
                        6⤵
                        • Suspicious behavior: MapViewOfSection
                        • Suspicious use of WriteProcessMemory
                        PID:2016
                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                          7⤵
                            PID:2008
                          • C:\Users\Admin\AppData\Local\Temp\4797508E2-20F2-4C2C-879A-1C358G.exe
                            "C:\Users\Admin\AppData\Local\Temp\4797508E2-20F2-4C2C-879A-1C358G.exe"
                            7⤵
                            • Suspicious behavior: MapViewOfSection
                            • Suspicious use of WriteProcessMemory
                            PID:1696
                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                              8⤵
                                PID:584
                              • C:\Users\Admin\AppData\Local\Temp\4797508E2-20F2-4C2C-879A-1C358G.exe
                                "C:\Users\Admin\AppData\Local\Temp\4797508E2-20F2-4C2C-879A-1C358G.exe"
                                8⤵
                                • Suspicious behavior: MapViewOfSection
                                • Suspicious use of WriteProcessMemory
                                PID:268
                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                                  9⤵
                                    PID:828
                                  • C:\Users\Admin\AppData\Local\Temp\4797508E2-20F2-4C2C-879A-1C358G.exe
                                    "C:\Users\Admin\AppData\Local\Temp\4797508E2-20F2-4C2C-879A-1C358G.exe"
                                    9⤵
                                    • Suspicious behavior: MapViewOfSection
                                    PID:1316
                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                                      10⤵
                                        PID:1008
                                      • C:\Users\Admin\AppData\Local\Temp\4797508E2-20F2-4C2C-879A-1C358G.exe
                                        "C:\Users\Admin\AppData\Local\Temp\4797508E2-20F2-4C2C-879A-1C358G.exe"
                                        10⤵
                                        • Suspicious behavior: MapViewOfSection
                                        PID:972
                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                                          11⤵
                                            PID:1484
                                          • C:\Users\Admin\AppData\Local\Temp\4797508E2-20F2-4C2C-879A-1C358G.exe
                                            "C:\Users\Admin\AppData\Local\Temp\4797508E2-20F2-4C2C-879A-1C358G.exe"
                                            11⤵
                                            • Suspicious behavior: MapViewOfSection
                                            PID:1220
                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                                              12⤵
                                                PID:1736
                                              • C:\Users\Admin\AppData\Local\Temp\4797508E2-20F2-4C2C-879A-1C358G.exe
                                                "C:\Users\Admin\AppData\Local\Temp\4797508E2-20F2-4C2C-879A-1C358G.exe"
                                                12⤵
                                                  PID:364

                          Network

                          MITRE ATT&CK Matrix

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads

                          • memory/268-74-0x0000000000000000-mapping.dmp
                            Download
                          • memory/268-76-0x00000000002DD000-0x00000000002E0000-memory.dmp
                            Filesize

                            12KB

                            Download
                          • memory/364-88-0x000000000041D000-0x0000000000420000-memory.dmp
                            Filesize

                            12KB

                            Download
                          • memory/364-86-0x0000000000000000-mapping.dmp
                            Download
                          • memory/972-82-0x00000000004BD000-0x00000000004C0000-memory.dmp
                            Filesize

                            12KB

                            Download
                          • memory/972-80-0x0000000000000000-mapping.dmp
                            Download
                          • memory/1220-85-0x000000000051D000-0x0000000000520000-memory.dmp
                            Filesize

                            12KB

                            Download
                          • memory/1220-83-0x0000000000000000-mapping.dmp
                            Download
                          • memory/1252-62-0x0000000000000000-mapping.dmp
                            Download
                          • memory/1252-64-0x000000000032D000-0x0000000000330000-memory.dmp
                            Filesize

                            12KB

                            Download
                          • memory/1268-59-0x0000000000000000-mapping.dmp
                            Download
                          • memory/1268-61-0x000000000039D000-0x00000000003A0000-memory.dmp
                            Filesize

                            12KB

                            Download
                          • memory/1316-79-0x000000000036D000-0x0000000000370000-memory.dmp
                            Filesize

                            12KB

                            Download
                          • memory/1316-77-0x0000000000000000-mapping.dmp
                            Download
                          • memory/1628-54-0x0000000075391000-0x0000000075393000-memory.dmp
                            Filesize

                            8KB

                            Download
                          • memory/1628-55-0x00000000004DD000-0x00000000004E0000-memory.dmp
                            Filesize

                            12KB

                            Download
                          • memory/1696-73-0x000000000047D000-0x0000000000480000-memory.dmp
                            Filesize

                            12KB

                            Download
                          • memory/1696-71-0x0000000000000000-mapping.dmp
                            Download
                          • memory/1956-58-0x00000000002CD000-0x00000000002D0000-memory.dmp
                            Filesize

                            12KB

                            Download
                          • memory/1956-56-0x0000000000000000-mapping.dmp
                            Download
                          • memory/2016-70-0x000000000045D000-0x0000000000460000-memory.dmp
                            Filesize

                            12KB

                            Download
                          • memory/2016-68-0x0000000000000000-mapping.dmp
                            Download
                          • memory/2044-65-0x0000000000000000-mapping.dmp
                            Download
                          • memory/2044-67-0x000000000037D000-0x0000000000380000-memory.dmp
                            Filesize

                            12KB

                            Download