Analysis
-
max time kernel
130s -
max time network
30s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
-
submitted
23-11-2022 19:06
General
-
Target
e9f3e1d083e5a67259f07cfa7ca913b10bdb069ee02436475324612380e368ff.exe
-
Size
1.2MB
-
MD5
7fc64e39913e66149e23f99e4a1c2825
-
SHA1
96f0e5a82eafefff763dbf091d362ca3f2781bc8
-
SHA256
e9f3e1d083e5a67259f07cfa7ca913b10bdb069ee02436475324612380e368ff
-
SHA512
676c5a973793a2dcaf3885369e1730320d9a0546cb134839d9ed7dad36b7d23933a98278e1da27cc59b6b37cf764f95da5aaabe917aa3498cfba3168f5e60c36
-
SSDEEP
24576:AxGNnZn10a1Kle9yg105sMhtzIh2GYMY9v65JgKoXeBXEdGnd:FXn10a1Kle9yg1059zk3bY9y5JvoOB0i
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 4 IoCs
-
Script User-Agent 2 IoCs
Uses user-agent string associated with script host/environment.
-
Suspicious behavior: EnumeratesProcesses 7 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e9f3e1d083e5a67259f07cfa7ca913b10bdb069ee02436475324612380e368ff.exe"C:\Users\Admin\AppData\Local\Temp\e9f3e1d083e5a67259f07cfa7ca913b10bdb069ee02436475324612380e368ff.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-L13CT.tmp\e9f3e1d083e5a67259f07cfa7ca913b10bdb069ee02436475324612380e368ff.tmp"C:\Users\Admin\AppData\Local\Temp\is-L13CT.tmp\e9f3e1d083e5a67259f07cfa7ca913b10bdb069ee02436475324612380e368ff.tmp" /SL5="$70126,797955,542208,C:\Users\Admin\AppData\Local\Temp\e9f3e1d083e5a67259f07cfa7ca913b10bdb069ee02436475324612380e368ff.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.5MB
MD5638e86d48e65151a7a2d09b58acce67a
SHA15af57b5a824578dd84e1c3a87366a77f50a6a3b8
SHA256b34ac0c2b01d6745458d8cf110f2d4d96feea38cc2689f144d558fc6d4b742dd
SHA51264cca21bd4296b2274f2fb2e5f1c8e37802f05b1f6bc5d5984f40faa08b0909caacad2b60df928344c08ec19f2c0c5a0ff8a6225e72d933092fd12d6e1dfc322
-
Filesize
111KB
MD55fddbad81d08a76147f762bc827777a9
SHA12e02d01d5f2231f1a1e8996177898599ce79a353
SHA2568b02e278494d5f8926021c1138568be678263f742934ebe17b2c4bb2a310e32e
SHA5121ea4455f2d42a74edae9dc671ab6a2699066da417df62c78cd67bb59261b5741f1ee1e3d3afe4b152dfb1be90d5073484440e8d7e49602d5be52f2ea235c61d3
-
Filesize
22KB
MD592dc6ef532fbb4a5c3201469a5b5eb63
SHA13e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA2569884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA5129908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3
-
Filesize
22KB
MD592dc6ef532fbb4a5c3201469a5b5eb63
SHA13e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA2569884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA5129908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3
-
Filesize
1.5MB
MD5638e86d48e65151a7a2d09b58acce67a
SHA15af57b5a824578dd84e1c3a87366a77f50a6a3b8
SHA256b34ac0c2b01d6745458d8cf110f2d4d96feea38cc2689f144d558fc6d4b742dd
SHA51264cca21bd4296b2274f2fb2e5f1c8e37802f05b1f6bc5d5984f40faa08b0909caacad2b60df928344c08ec19f2c0c5a0ff8a6225e72d933092fd12d6e1dfc322
-
-
Filesize
8KB
-
Filesize
572KB
-
Filesize
572KB