05af298adf0dc76f01b300a7b2bc7a937048b3f682dd11451af09cbacab09b0e

Analysis

max time kernel
29s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 16:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

05af298adf0dc76f01b300a7b2bc7a937048b3f682dd11451af09cbacab09b0e.exe
Size

711KB
MD5

50c6b095829e2e7548e4c0e5697a2af0
SHA1

607a48d5c5b426d5ce8c907a7dcdcccd26ce3703
SHA256

05af298adf0dc76f01b300a7b2bc7a937048b3f682dd11451af09cbacab09b0e
SHA512

7388f00593827375e877d862c04e2f5fa06bf37ee30fb7a687adf31a07f3a2804b097e16b9224d21b3b1df8b3e4e661400ba285640932292d9f394d5e3b3c3e6
SSDEEP

12288:qLM2vy7hCILsOuW2Q6Y2BVQ428W+vqWt0S9SiPYZZz1SHU1vOjYt/8DIhd7OwLM:gMhCILsOuWeBVl2b+vhOUpkpSHU1r/e8

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

~DFA68.tmp

pid process

268 ~DFA68.tmp

pid	process
268	~DFA68.tmp

Loads dropped DLL 2 IoCs

Processes:

05af298adf0dc76f01b300a7b2bc7a937048b3f682dd11451af09cbacab09b0e.exe

pid	process
1372	05af298adf0dc76f01b300a7b2bc7a937048b3f682dd11451af09cbacab09b0e.exe
1372	05af298adf0dc76f01b300a7b2bc7a937048b3f682dd11451af09cbacab09b0e.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

05af298adf0dc76f01b300a7b2bc7a937048b3f682dd11451af09cbacab09b0e.exe

description	pid	process	target process
PID 1372 wrote to memory of 268	1372	05af298adf0dc76f01b300a7b2bc7a937048b3f682dd11451af09cbacab09b0e.exe	~DFA68.tmp
PID 1372 wrote to memory of 268	1372	05af298adf0dc76f01b300a7b2bc7a937048b3f682dd11451af09cbacab09b0e.exe	~DFA68.tmp
PID 1372 wrote to memory of 268	1372	05af298adf0dc76f01b300a7b2bc7a937048b3f682dd11451af09cbacab09b0e.exe	~DFA68.tmp
PID 1372 wrote to memory of 268	1372	05af298adf0dc76f01b300a7b2bc7a937048b3f682dd11451af09cbacab09b0e.exe	~DFA68.tmp

C:\Users\Admin\AppData\Local\Temp\05af298adf0dc76f01b300a7b2bc7a937048b3f682dd11451af09cbacab09b0e.exe
"C:\Users\Admin\AppData\Local\Temp\05af298adf0dc76f01b300a7b2bc7a937048b3f682dd11451af09cbacab09b0e.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1372

C:\Users\Admin\AppData\Local\Temp\~DFA68.tmp
C:\Users\Admin\AppData\Local\Temp\~DFA68.tmp OK
2⤵
- Executes dropped EXE
PID:268

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\~DFA68.tmp
Filesize
715KB

MD5
d7404da932becd8e3115300743a38190

SHA1
77e879f69ee9aa3d7a4640e2a600e91aa080bb6a

SHA256
8d5ceb5d3921fec924c08e263ec2e496051b0c954135122d3773dbd5219c9ec6

SHA512
660912165374cbb5186431a5a0fea9260c6a41940e80bd713a7beb441de1e88d06d82779f91f55af4287ece9914b02f0682e1e6ce9b6aa95538d587fec013c1b

Download Submit
\Users\Admin\AppData\Local\Temp\~DFA68.tmp
Filesize
715KB

MD5
d7404da932becd8e3115300743a38190

SHA1
77e879f69ee9aa3d7a4640e2a600e91aa080bb6a

SHA256
8d5ceb5d3921fec924c08e263ec2e496051b0c954135122d3773dbd5219c9ec6

SHA512
660912165374cbb5186431a5a0fea9260c6a41940e80bd713a7beb441de1e88d06d82779f91f55af4287ece9914b02f0682e1e6ce9b6aa95538d587fec013c1b

Download Submit
\Users\Admin\AppData\Local\Temp\~DFA68.tmp
Filesize
715KB

MD5
d7404da932becd8e3115300743a38190

SHA1
77e879f69ee9aa3d7a4640e2a600e91aa080bb6a

SHA256
8d5ceb5d3921fec924c08e263ec2e496051b0c954135122d3773dbd5219c9ec6

SHA512
660912165374cbb5186431a5a0fea9260c6a41940e80bd713a7beb441de1e88d06d82779f91f55af4287ece9914b02f0682e1e6ce9b6aa95538d587fec013c1b

Download Submit
memory/268-57-0x0000000000000000-mapping.dmp

Download
memory/268-61-0x0000000000D60000-0x0000000000E27000-memory.dmp

Filesize
796KB

Download
memory/268-62-0x0000000000D60000-0x0000000000E27000-memory.dmp

Filesize
796KB

Download
memory/1372-54-0x0000000076B51000-0x0000000076B53000-memory.dmp

Filesize
8KB

Download
memory/1372-60-0x00000000012E0000-0x00000000013A7000-memory.dmp

Filesize
796KB

Download