Analysis
-
max time kernel
167s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
-
submitted
01/12/2022, 10:14
General
-
Target
198528b928b2b7756006743717849060fc5834c8083ebf01997829d717c4bf79.exe
-
Size
96KB
-
MD5
50203ebced4420b5d9ef53fd09541050
-
SHA1
ec4d61979e226978fb84686821bdf4f394ea6a79
-
SHA256
198528b928b2b7756006743717849060fc5834c8083ebf01997829d717c4bf79
-
SHA512
61b2d6e01f95a184eedfdd88ddbeabe52083028cb2b6d958ad93b288b63f9cba54058523bc2baa3e369ac6b6796c9b78ae916a562728609eb3eba55150f0f99c
-
SSDEEP
1536:2jNFkHqPUeDEoCyGpEUOIeYYJl03R8YN4weVXjmoQg4DQjM5:IksUeDEoCbOIVCWt4xmoeT5
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
-
Deletes itself 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\198528b928b2b7756006743717849060fc5834c8083ebf01997829d717c4bf79.exe"C:\Users\Admin\AppData\Local\Temp\198528b928b2b7756006743717849060fc5834c8083ebf01997829d717c4bf79.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Documents\Application Data\explorer.exe"C:\Users\Admin\Documents\Application Data\explorer.exe"2⤵
- Executes dropped EXE
- Deletes itself
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Documents\Application Data\explorer.exe"C:\Users\Admin\Documents\Application Data\explorer.exe" -addcopy3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
32B
MD56cafc4e932370d5d2a8a4273086e3a0c
SHA1a3763736332ca510b5111e38959913b148937aaa
SHA256969755c1d1d6fa09da44ef526f5d362ea62974ba516bf21030c07cd7c831cea1
SHA5127a7fda27969cec7f3f162fd526f6d8289f41ed212a00ad97d2b52e452db83afe1a3b8ac66b70cbf396162033dcfde17f701051bdf048a85b3e4378d7409a5a3c
-
Filesize
96KB
MD550203ebced4420b5d9ef53fd09541050
SHA1ec4d61979e226978fb84686821bdf4f394ea6a79
SHA256198528b928b2b7756006743717849060fc5834c8083ebf01997829d717c4bf79
SHA51261b2d6e01f95a184eedfdd88ddbeabe52083028cb2b6d958ad93b288b63f9cba54058523bc2baa3e369ac6b6796c9b78ae916a562728609eb3eba55150f0f99c
-
Filesize
96KB
MD550203ebced4420b5d9ef53fd09541050
SHA1ec4d61979e226978fb84686821bdf4f394ea6a79
SHA256198528b928b2b7756006743717849060fc5834c8083ebf01997829d717c4bf79
SHA51261b2d6e01f95a184eedfdd88ddbeabe52083028cb2b6d958ad93b288b63f9cba54058523bc2baa3e369ac6b6796c9b78ae916a562728609eb3eba55150f0f99c
-
Filesize
96KB
MD550203ebced4420b5d9ef53fd09541050
SHA1ec4d61979e226978fb84686821bdf4f394ea6a79
SHA256198528b928b2b7756006743717849060fc5834c8083ebf01997829d717c4bf79
SHA51261b2d6e01f95a184eedfdd88ddbeabe52083028cb2b6d958ad93b288b63f9cba54058523bc2baa3e369ac6b6796c9b78ae916a562728609eb3eba55150f0f99c
-
Filesize
96KB
MD550203ebced4420b5d9ef53fd09541050
SHA1ec4d61979e226978fb84686821bdf4f394ea6a79
SHA256198528b928b2b7756006743717849060fc5834c8083ebf01997829d717c4bf79
SHA51261b2d6e01f95a184eedfdd88ddbeabe52083028cb2b6d958ad93b288b63f9cba54058523bc2baa3e369ac6b6796c9b78ae916a562728609eb3eba55150f0f99c
-
Filesize
96KB
MD550203ebced4420b5d9ef53fd09541050
SHA1ec4d61979e226978fb84686821bdf4f394ea6a79
SHA256198528b928b2b7756006743717849060fc5834c8083ebf01997829d717c4bf79
SHA51261b2d6e01f95a184eedfdd88ddbeabe52083028cb2b6d958ad93b288b63f9cba54058523bc2baa3e369ac6b6796c9b78ae916a562728609eb3eba55150f0f99c
-
Filesize
136KB
-
Filesize
136KB
-
Filesize
136KB
-
Filesize
136KB
-
Filesize
136KB
-
Filesize
8KB
-
Filesize
136KB
-
Filesize
136KB