Analysis

  • max time kernel
    71s
  • max time network
    138s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/01/2023, 18:12

General

  • Target

    9e59abc12bb3bda44fb0a73d9b43d89cd62cadd5521f6f350014577d5de7c602.exe

  • Size

    13.9MB

  • MD5

    b21f5982a2f2978b48a1b3b46966ffcb

  • SHA1

    b702da854a30d8ece9415ebee9880745f3c76c86

  • SHA256

    9e59abc12bb3bda44fb0a73d9b43d89cd62cadd5521f6f350014577d5de7c602

  • SHA512

    7b1cdb4f318eec142ba30e73e0e418c278973980868f86cc8d3056b00668114464e042d74e66f477cadebf9c4733d396fbf876cc32f99755dc4056355845612e

  • SSDEEP

    196608:90g9dYWFlSS6Xaic03L4IdVgGTD71RewRxfHZdF071s2pK1HO+Cw1s/eiGPeH:9dPN9ic1GOsVRx5dFfP1u+F1s/eiTH

Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\9e59abc12bb3bda44fb0a73d9b43d89cd62cadd5521f6f350014577d5de7c602.exe
    "C:\Users\Admin\AppData\Local\Temp\9e59abc12bb3bda44fb0a73d9b43d89cd62cadd5521f6f350014577d5de7c602.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1104
    • C:\Users\Admin\AppData\Local\Temp\is-RA6LO.tmp\9e59abc12bb3bda44fb0a73d9b43d89cd62cadd5521f6f350014577d5de7c602.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-RA6LO.tmp\9e59abc12bb3bda44fb0a73d9b43d89cd62cadd5521f6f350014577d5de7c602.tmp" /SL5="$90054,14348540,56832,C:\Users\Admin\AppData\Local\Temp\9e59abc12bb3bda44fb0a73d9b43d89cd62cadd5521f6f350014577d5de7c602.exe"
      2⤵
      • Executes dropped EXE
      PID:1960

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\is-RA6LO.tmp\9e59abc12bb3bda44fb0a73d9b43d89cd62cadd5521f6f350014577d5de7c602.tmp

    Filesize

    701KB

    MD5

    1ff30f1553f38ebe433432cfbbcadc67

    SHA1

    8d64a95509fe49ef252c8906687c58e84f6bc519

    SHA256

    35cd85d5ef97558dea22a5f9d9dfb23cc465b8f113f6825d82c2a2b1870dd831

    SHA512

    0c17dbd75ed839acaa18b34c023d7017a0acf18bf6c48f6cd21438dad61a94e254c401036f713837ddbf795d43975776e3e04f2fbf131ff74fa129803df2ce41

  • C:\Users\Admin\AppData\Local\Temp\is-RA6LO.tmp\9e59abc12bb3bda44fb0a73d9b43d89cd62cadd5521f6f350014577d5de7c602.tmp

    Filesize

    701KB

    MD5

    1ff30f1553f38ebe433432cfbbcadc67

    SHA1

    8d64a95509fe49ef252c8906687c58e84f6bc519

    SHA256

    35cd85d5ef97558dea22a5f9d9dfb23cc465b8f113f6825d82c2a2b1870dd831

    SHA512

    0c17dbd75ed839acaa18b34c023d7017a0acf18bf6c48f6cd21438dad61a94e254c401036f713837ddbf795d43975776e3e04f2fbf131ff74fa129803df2ce41

  • memory/1104-132-0x0000000000400000-0x0000000000415000-memory.dmp

    Filesize

    84KB

  • memory/1104-137-0x0000000000400000-0x0000000000415000-memory.dmp

    Filesize

    84KB