Analysis
-
max time kernel
149s -
max time network
157s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
23-11-2022 14:31
Static task
static1
Behavioral task
behavioral1
Sample
3edfb68de802811ba9b7bea27a0b43115e5679402da481f60f536f294dab1478.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
3edfb68de802811ba9b7bea27a0b43115e5679402da481f60f536f294dab1478.exe
Resource
win10v2004-20221111-en
General
-
Target
3edfb68de802811ba9b7bea27a0b43115e5679402da481f60f536f294dab1478.exe
-
Size
39KB
-
MD5
1358b9b8bd1bea32d8d5594472bad968
-
SHA1
e86792206f9f5705f0aa27b38589b8284bcdb36d
-
SHA256
3edfb68de802811ba9b7bea27a0b43115e5679402da481f60f536f294dab1478
-
SHA512
ea6330fc7137ba2b6c318a9d95e5c4a9026dcdff44f247d1927c6381850156bda2f9e35d0f808bdd6c194c63bef3673edd13ede565f91dc16ab75c85e9cb9332
-
SSDEEP
768:+tnzxojeXvjzMUxHZziFlPGXXnHyeOBQehmfZggmuvCRo:+1xojuvMUJ5HnSeOmfZHeo
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
3BD9.tmppid process 576 3BD9.tmp -
Deletes itself 1 IoCs
Processes:
3BD9.tmppid process 576 3BD9.tmp -
Loads dropped DLL 2 IoCs
Processes:
3edfb68de802811ba9b7bea27a0b43115e5679402da481f60f536f294dab1478.exepid process 1872 3edfb68de802811ba9b7bea27a0b43115e5679402da481f60f536f294dab1478.exe 1872 3edfb68de802811ba9b7bea27a0b43115e5679402da481f60f536f294dab1478.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
3edfb68de802811ba9b7bea27a0b43115e5679402da481f60f536f294dab1478.exedescription pid process target process PID 1872 wrote to memory of 576 1872 3edfb68de802811ba9b7bea27a0b43115e5679402da481f60f536f294dab1478.exe 3BD9.tmp PID 1872 wrote to memory of 576 1872 3edfb68de802811ba9b7bea27a0b43115e5679402da481f60f536f294dab1478.exe 3BD9.tmp PID 1872 wrote to memory of 576 1872 3edfb68de802811ba9b7bea27a0b43115e5679402da481f60f536f294dab1478.exe 3BD9.tmp PID 1872 wrote to memory of 576 1872 3edfb68de802811ba9b7bea27a0b43115e5679402da481f60f536f294dab1478.exe 3BD9.tmp
Processes
-
C:\Users\Admin\AppData\Local\Temp\3edfb68de802811ba9b7bea27a0b43115e5679402da481f60f536f294dab1478.exe"C:\Users\Admin\AppData\Local\Temp\3edfb68de802811ba9b7bea27a0b43115e5679402da481f60f536f294dab1478.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3BD9.tmp"C:\Users\Admin\AppData\Local\Temp\3BD9.tmp" "C:\Users\Admin\AppData\Local\Temp\3edfb68de802811ba9b7bea27a0b43115e5679402da481f60f536f294dab1478.exe"2⤵
- Executes dropped EXE
- Deletes itself
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\3BD9.tmpFilesize
39KB
MD51358b9b8bd1bea32d8d5594472bad968
SHA1e86792206f9f5705f0aa27b38589b8284bcdb36d
SHA2563edfb68de802811ba9b7bea27a0b43115e5679402da481f60f536f294dab1478
SHA512ea6330fc7137ba2b6c318a9d95e5c4a9026dcdff44f247d1927c6381850156bda2f9e35d0f808bdd6c194c63bef3673edd13ede565f91dc16ab75c85e9cb9332
-
\Users\Admin\AppData\Local\Temp\3BD9.tmpFilesize
39KB
MD51358b9b8bd1bea32d8d5594472bad968
SHA1e86792206f9f5705f0aa27b38589b8284bcdb36d
SHA2563edfb68de802811ba9b7bea27a0b43115e5679402da481f60f536f294dab1478
SHA512ea6330fc7137ba2b6c318a9d95e5c4a9026dcdff44f247d1927c6381850156bda2f9e35d0f808bdd6c194c63bef3673edd13ede565f91dc16ab75c85e9cb9332
-
\Users\Admin\AppData\Local\Temp\3BD9.tmpFilesize
39KB
MD51358b9b8bd1bea32d8d5594472bad968
SHA1e86792206f9f5705f0aa27b38589b8284bcdb36d
SHA2563edfb68de802811ba9b7bea27a0b43115e5679402da481f60f536f294dab1478
SHA512ea6330fc7137ba2b6c318a9d95e5c4a9026dcdff44f247d1927c6381850156bda2f9e35d0f808bdd6c194c63bef3673edd13ede565f91dc16ab75c85e9cb9332
-
memory/576-58-0x0000000000000000-mapping.dmp
-
memory/1872-54-0x0000000075841000-0x0000000075843000-memory.dmpFilesize
8KB
-
memory/1872-55-0x0000000000400000-0x000000000040D000-memory.dmpFilesize
52KB