Analysis
-
max time kernel
42s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
07/12/2022, 02:16
Static task
static1
Behavioral task
behavioral1
Sample
b47938894b910450c0c55685f0828bfd50b0cd8fe9e3075ae872c37cefcbf517.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
b47938894b910450c0c55685f0828bfd50b0cd8fe9e3075ae872c37cefcbf517.exe
Resource
win10v2004-20220812-en
General
-
Target
b47938894b910450c0c55685f0828bfd50b0cd8fe9e3075ae872c37cefcbf517.exe
-
Size
611KB
-
MD5
2d62bae0fb6c97273904ec6b7ae3bb80
-
SHA1
d3fbdd09c91d6b5ab079496970795f80e16b6700
-
SHA256
b47938894b910450c0c55685f0828bfd50b0cd8fe9e3075ae872c37cefcbf517
-
SHA512
46c7594ac99f6127d6c57d7d35247999c7b387d605f20ee5dabc22e2694f8f32a5475501a645a8836b1a864f52925540e4c1f691b10cfe6b30228842531a2f88
-
SSDEEP
12288:mEtDt+QFAYvL7+3uhyMNfAsLfozPCOZ/5hNeGX9UZPTjOpMZaBY/x4b7GE:LTdvvdBfAXTBhqt4MZaB3r
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 940 ~DFA7F.tmp -
Loads dropped DLL 1 IoCs
pid Process 1072 b47938894b910450c0c55685f0828bfd50b0cd8fe9e3075ae872c37cefcbf517.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1072 wrote to memory of 940 1072 b47938894b910450c0c55685f0828bfd50b0cd8fe9e3075ae872c37cefcbf517.exe 27 PID 1072 wrote to memory of 940 1072 b47938894b910450c0c55685f0828bfd50b0cd8fe9e3075ae872c37cefcbf517.exe 27 PID 1072 wrote to memory of 940 1072 b47938894b910450c0c55685f0828bfd50b0cd8fe9e3075ae872c37cefcbf517.exe 27 PID 1072 wrote to memory of 940 1072 b47938894b910450c0c55685f0828bfd50b0cd8fe9e3075ae872c37cefcbf517.exe 27
Processes
-
C:\Users\Admin\AppData\Local\Temp\b47938894b910450c0c55685f0828bfd50b0cd8fe9e3075ae872c37cefcbf517.exe"C:\Users\Admin\AppData\Local\Temp\b47938894b910450c0c55685f0828bfd50b0cd8fe9e3075ae872c37cefcbf517.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1072 -
C:\Users\Admin\AppData\Local\Temp\~DFA7F.tmpC:\Users\Admin\AppData\Local\Temp\~DFA7F.tmp OK2⤵
- Executes dropped EXE
PID:940
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
618KB
MD54d454328e2bf86e9cc7acdc52717cffb
SHA1d8c325386c9295e9eec80c6af30c0ac47e373bbf
SHA256c375832f0abaffed440dcb3117c5f2b6e2906f4d46f03f7e828c14c27c90333b
SHA5122802bef5837e691df0317670a4bbaee85e478cd0da3313f766f629397edd99116c4f07d4ae2425e0fea858ceb03bdc44163d0e0021235b631ea014dfad3408d4
-
Filesize
618KB
MD54d454328e2bf86e9cc7acdc52717cffb
SHA1d8c325386c9295e9eec80c6af30c0ac47e373bbf
SHA256c375832f0abaffed440dcb3117c5f2b6e2906f4d46f03f7e828c14c27c90333b
SHA5122802bef5837e691df0317670a4bbaee85e478cd0da3313f766f629397edd99116c4f07d4ae2425e0fea858ceb03bdc44163d0e0021235b631ea014dfad3408d4