Overview

overview

8

Static

static

e9f3e1d083...ff.exe

windows7-x64

8

e9f3e1d083...ff.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    117s
  • max time network
    144s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23-11-2022 19:06

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    e9f3e1d083e5a67259f07cfa7ca913b10bdb069ee02436475324612380e368ff.exe

  • Size

    1.2MB

  • MD5

    7fc64e39913e66149e23f99e4a1c2825

  • SHA1

    96f0e5a82eafefff763dbf091d362ca3f2781bc8

  • SHA256

    e9f3e1d083e5a67259f07cfa7ca913b10bdb069ee02436475324612380e368ff

  • SHA512

    676c5a973793a2dcaf3885369e1730320d9a0546cb134839d9ed7dad36b7d23933a98278e1da27cc59b6b37cf764f95da5aaabe917aa3498cfba3168f5e60c36

  • SSDEEP

    24576:AxGNnZn10a1Kle9yg105sMhtzIh2GYMY9v65JgKoXeBXEdGnd:FXn10a1Kle9yg1059zk3bY9y5JvoOB0i

Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e9f3e1d083e5a67259f07cfa7ca913b10bdb069ee02436475324612380e368ff.exe
    "C:\Users\Admin\AppData\Local\Temp\e9f3e1d083e5a67259f07cfa7ca913b10bdb069ee02436475324612380e368ff.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3460
    • C:\Users\Admin\AppData\Local\Temp\is-QDQ10.tmp\e9f3e1d083e5a67259f07cfa7ca913b10bdb069ee02436475324612380e368ff.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-QDQ10.tmp\e9f3e1d083e5a67259f07cfa7ca913b10bdb069ee02436475324612380e368ff.tmp" /SL5="$A0052,797955,542208,C:\Users\Admin\AppData\Local\Temp\e9f3e1d083e5a67259f07cfa7ca913b10bdb069ee02436475324612380e368ff.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      PID:3736

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\is-103MM.tmp\InstallerExtensions.dll
    Filesize

    111KB

    MD5

    5fddbad81d08a76147f762bc827777a9

    SHA1

    2e02d01d5f2231f1a1e8996177898599ce79a353

    SHA256

    8b02e278494d5f8926021c1138568be678263f742934ebe17b2c4bb2a310e32e

    SHA512

    1ea4455f2d42a74edae9dc671ab6a2699066da417df62c78cd67bb59261b5741f1ee1e3d3afe4b152dfb1be90d5073484440e8d7e49602d5be52f2ea235c61d3

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\is-QDQ10.tmp\e9f3e1d083e5a67259f07cfa7ca913b10bdb069ee02436475324612380e368ff.tmp
    Filesize

    1.5MB

    MD5

    638e86d48e65151a7a2d09b58acce67a

    SHA1

    5af57b5a824578dd84e1c3a87366a77f50a6a3b8

    SHA256

    b34ac0c2b01d6745458d8cf110f2d4d96feea38cc2689f144d558fc6d4b742dd

    SHA512

    64cca21bd4296b2274f2fb2e5f1c8e37802f05b1f6bc5d5984f40faa08b0909caacad2b60df928344c08ec19f2c0c5a0ff8a6225e72d933092fd12d6e1dfc322

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\is-QDQ10.tmp\e9f3e1d083e5a67259f07cfa7ca913b10bdb069ee02436475324612380e368ff.tmp
    Filesize

    1.5MB

    MD5

    638e86d48e65151a7a2d09b58acce67a

    SHA1

    5af57b5a824578dd84e1c3a87366a77f50a6a3b8

    SHA256

    b34ac0c2b01d6745458d8cf110f2d4d96feea38cc2689f144d558fc6d4b742dd

    SHA512

    64cca21bd4296b2274f2fb2e5f1c8e37802f05b1f6bc5d5984f40faa08b0909caacad2b60df928344c08ec19f2c0c5a0ff8a6225e72d933092fd12d6e1dfc322

    Download Submit
  • memory/3460-132-0x0000000000400000-0x000000000048F000-memory.dmp
    Filesize

    572KB

    Download
  • memory/3460-137-0x0000000000400000-0x000000000048F000-memory.dmp
    Filesize

    572KB

    Download
  • memory/3460-139-0x0000000000400000-0x000000000048F000-memory.dmp
    Filesize

    572KB

    Download
  • memory/3736-134-0x0000000000000000-mapping.dmp
    Download