Analysis
-
max time kernel
38s -
max time network
48s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
30-05-2022 03:50
Static task
static1
Behavioral task
behavioral1
Sample
miniramon8.exe
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
miniramon8.exe
Resource
win10v2004-20220414-en
windows10-2004_x64
0 signatures
0 seconds
General
-
Target
miniramon8.exe
-
Size
132KB
-
MD5
3a85cbd54b6c1afadaf06fbc6f1ef9b4
-
SHA1
9c4a8786144bc43b06e37e2cbd9ecb4cb0332627
-
SHA256
ffb6cf0788bc9fef9314085cf23fbdf87bfde9c3b78f014d5fd3e76d769cc82c
-
SHA512
ec5d74354d29089ec70750987176ee8282575e3db038cc79b8f4b58c71672ea5ece93f0ae8b8aca4cf75e12ede927cbf3d873d0dc1f26da64b5ce88de8420b16
Score
7/10
Malware Config
Signatures
-
Deletes itself 1 IoCs
Processes:
svchost.exepid process 1268 svchost.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
miniramon8.exesvchost.exepid process 1420 miniramon8.exe 1420 miniramon8.exe 1268 svchost.exe 1268 svchost.exe -
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
miniramon8.exedescription pid process target process PID 1420 wrote to memory of 1268 1420 miniramon8.exe svchost.exe PID 1420 wrote to memory of 1268 1420 miniramon8.exe svchost.exe PID 1420 wrote to memory of 1268 1420 miniramon8.exe svchost.exe PID 1420 wrote to memory of 1268 1420 miniramon8.exe svchost.exe PID 1420 wrote to memory of 1268 1420 miniramon8.exe svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\miniramon8.exe"C:\Users\Admin\AppData\Local\Temp\miniramon8.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1420 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe "C:\Users\Admin\AppData\Local\Temp\miniramon8.exe"2⤵
- Deletes itself
- Suspicious behavior: EnumeratesProcesses
PID:1268
-