Overview

overview

8

Static

static

f678aec1f5...1d.exe

windows7-x64

8

f678aec1f5...1d.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    152s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    26/10/2022, 01:42

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    f678aec1f5329789b758d22bed5980cf4f47dd771c4b0bd5812eeb14198d051d.exe

  • Size

    275KB

  • MD5

    f308b84f9d86603a6da062a2bdb39cac

  • SHA1

    fbeffa677d5793b4aed63f0e24b83956b432e265

  • SHA256

    f678aec1f5329789b758d22bed5980cf4f47dd771c4b0bd5812eeb14198d051d

  • SHA512

    348cbcc3aad5f3deed87a53bbcc6586c244a0a87d0a205f68d6b41b9ee9380012a7ca51c094c8407de554b50aea85a834553ae18a1ffb8a41f0ae7a1034621ff

  • SSDEEP

    6144:S2udwvUa65YC816HzafM3rcsqsqshvX5giNZ:Zudw/6H13resqEKiNZ

Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 29 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f678aec1f5329789b758d22bed5980cf4f47dd771c4b0bd5812eeb14198d051d.exe
    "C:\Users\Admin\AppData\Local\Temp\f678aec1f5329789b758d22bed5980cf4f47dd771c4b0bd5812eeb14198d051d.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: RenamesItself
    • Suspicious use of WriteProcessMemory
    PID:1680
    • C:\Users\Admin\AppData\Local\Temp\f678aec1f5329789b758d22bed5980cf4f47dd771c4b0bd5812eeb14198d051d.exe
      C:\Users\Admin\AppData\Local\Temp\f678aec1f5329789b758d22bed5980cf4f47dd771c4b0bd5812eeb14198d051d.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of UnmapMainImage
      PID:1964

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\f678aec1f5329789b758d22bed5980cf4f47dd771c4b0bd5812eeb14198d051d.exe
    Filesize

    275KB

    MD5

    c72b3a8836c4d77345d778e9945b64a5

    SHA1

    e12d268145573245a71d9dcc26f0d6f6c50c503e

    SHA256

    016304dbdd18ab7894b827881aafe720dd5acaceaed746e1484f1da01485a5ec

    SHA512

    84545cfb7f25af19ad1708cad5109d035aeecee3215dbd995f372b969c5d229f0135627cb1bba1cfe5f3b1c92a70f5fa637a5a6db9bce9a9f0882ab16aff05c7

    Download Submit

  • \Users\Admin\AppData\Local\Temp\f678aec1f5329789b758d22bed5980cf4f47dd771c4b0bd5812eeb14198d051d.exe
    Filesize

    275KB

    MD5

    c72b3a8836c4d77345d778e9945b64a5

    SHA1

    e12d268145573245a71d9dcc26f0d6f6c50c503e

    SHA256

    016304dbdd18ab7894b827881aafe720dd5acaceaed746e1484f1da01485a5ec

    SHA512

    84545cfb7f25af19ad1708cad5109d035aeecee3215dbd995f372b969c5d229f0135627cb1bba1cfe5f3b1c92a70f5fa637a5a6db9bce9a9f0882ab16aff05c7

    Download Submit

  • memory/1680-57-0x0000000000400000-0x000000000044D000-memory.dmp

    Filesize

    308KB

    Download

  • memory/1964-60-0x00000000001B0000-0x00000000001FD000-memory.dmp

    Filesize

    308KB

    Download

  • memory/1964-61-0x0000000000400000-0x000000000044D000-memory.dmp

    Filesize

    308KB

    Download

  • memory/1964-62-0x0000000000400000-0x000000000044D000-memory.dmp

    Filesize

    308KB

    Download