Analysis
-
max time kernel
61s -
max time network
125s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
-
submitted
23-11-2022 19:06
General
-
Target
9eb020e659684be447ce9188d2304ed24dfc3b905d847a5e56a3e54d91f780f2.exe
-
Size
1.2MB
-
MD5
0709bbb08dba7486fbf957566901cca0
-
SHA1
17d02f492f8783173e90fd864d443f25be8ccf96
-
SHA256
9eb020e659684be447ce9188d2304ed24dfc3b905d847a5e56a3e54d91f780f2
-
SHA512
79593f7d1e6a814ce3583fb97d3250abe0a417f46a81a6f59c23be1fe7ec05863ebe71f43ebc907f1cf317eeb6ef367e0e314bdfc9a73efa67188c7a10309505
-
SSDEEP
24576:mxGNnZn10a1Kle9yg1058ThBwFvD6YnunOqPuefLcjyKi:rXn10a1Kle9yg105UwFvD6uuOaJLcjk
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Script User-Agent 2 IoCs
Uses user-agent string associated with script host/environment.
-
Suspicious behavior: EnumeratesProcesses 14 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\9eb020e659684be447ce9188d2304ed24dfc3b905d847a5e56a3e54d91f780f2.exe"C:\Users\Admin\AppData\Local\Temp\9eb020e659684be447ce9188d2304ed24dfc3b905d847a5e56a3e54d91f780f2.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-LQHU6.tmp\9eb020e659684be447ce9188d2304ed24dfc3b905d847a5e56a3e54d91f780f2.tmp"C:\Users\Admin\AppData\Local\Temp\is-LQHU6.tmp\9eb020e659684be447ce9188d2304ed24dfc3b905d847a5e56a3e54d91f780f2.tmp" /SL5="$D01EE,797829,542208,C:\Users\Admin\AppData\Local\Temp\9eb020e659684be447ce9188d2304ed24dfc3b905d847a5e56a3e54d91f780f2.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
111KB
MD5af92c4e97ea31b38e74681c10ce052e1
SHA1cf1b46fb621093ff3ba83d10e15e3745f5b1fb5b
SHA256478e1d73b268a333a309fe2ef5fe9334a1ad5c69cf23e242ae822043e3c30cd4
SHA512cce7959be39b80b98840b96fe9d8da9d52b6e997021345838ca5dde8b20164c87ff8c1f49146f3a11a0e73edd3831f6398ae7106fc9a387885a7e9cb23c374e3
-
Filesize
1.5MB
MD58e2de887fbd8d0f3efed8569ce147893
SHA1b55ebb74e968c94730ae57f17866b26b4db31954
SHA2569ecb1c9725fb343bbbba3e50b8765ffb44dd1d0777c51b7ba82321622d6064c3
SHA51272935374b0fa7c09311ae7f50e79ef5c6bfe11c04c961abb6c1be631ac93133bcf244f6e24e6a65cc2964c8b4781c941229bbbd025850a5b6832d2cf07a965be
-
Filesize
1.5MB
MD58e2de887fbd8d0f3efed8569ce147893
SHA1b55ebb74e968c94730ae57f17866b26b4db31954
SHA2569ecb1c9725fb343bbbba3e50b8765ffb44dd1d0777c51b7ba82321622d6064c3
SHA51272935374b0fa7c09311ae7f50e79ef5c6bfe11c04c961abb6c1be631ac93133bcf244f6e24e6a65cc2964c8b4781c941229bbbd025850a5b6832d2cf07a965be
-
-
Filesize
572KB
-
Filesize
572KB
-
Filesize
572KB