Analysis
-
max time kernel
142s -
max time network
34s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
-
submitted
21/05/2023, 15:51
General
-
Target
581f8428d878f327176c24c378fd2e0e660bdfde9afa550e920164240049b9c7.exe
-
Size
19.0MB
-
MD5
b8e7c5bb7a9669ef1bb8cad24fe1ba6a
-
SHA1
fae9bec58b12eb25db995fd6701442ed8f24a46b
-
SHA256
581f8428d878f327176c24c378fd2e0e660bdfde9afa550e920164240049b9c7
-
SHA512
3655a27a93be07e789afd2dde75cede5e114835583e01f71c51d27a7929f4e17b089d58fcf408e989bb3d88e542cab33398c21d4eec45a90dcdcc649f875abaf
-
SSDEEP
393216:fGZiYKGtAeGFiYKGtAeGFi0KGtAeGFi0K6tAjGFi0j8YY+:eZNH+FNH+FZH+FZrTFZDV
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\581f8428d878f327176c24c378fd2e0e660bdfde9afa550e920164240049b9c7.exe"C:\Users\Admin\AppData\Local\Temp\581f8428d878f327176c24c378fd2e0e660bdfde9afa550e920164240049b9c7.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-C48OU.tmp\581f8428d878f327176c24c378fd2e0e660bdfde9afa550e920164240049b9c7.tmp"C:\Users\Admin\AppData\Local\Temp\is-C48OU.tmp\581f8428d878f327176c24c378fd2e0e660bdfde9afa550e920164240049b9c7.tmp" /SL5="$70126,19098918,780800,C:\Users\Admin\AppData\Local\Temp\581f8428d878f327176c24c378fd2e0e660bdfde9afa550e920164240049b9c7.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.9MB
MD5e1db7b0b4f4da66444fecc8484101a30
SHA115138fa43fbe820fa1d0bd0548f921623f5b0e3c
SHA256faf45ece49adb213d5afd54808d51cfa794b19935f3e1b148392cb0ae1e19a59
SHA51276bc4ce9c9db01598ff0e6bd38b013f642bd4ae4bf85c2fd1fd71bf513808980c7f5d92ea6fd235f7e37194d58f5e3c08c15829b002233367034ed58b367b5e2
-
Filesize
2.9MB
MD5e1db7b0b4f4da66444fecc8484101a30
SHA115138fa43fbe820fa1d0bd0548f921623f5b0e3c
SHA256faf45ece49adb213d5afd54808d51cfa794b19935f3e1b148392cb0ae1e19a59
SHA51276bc4ce9c9db01598ff0e6bd38b013f642bd4ae4bf85c2fd1fd71bf513808980c7f5d92ea6fd235f7e37194d58f5e3c08c15829b002233367034ed58b367b5e2
-
Filesize
816KB
-
Filesize
816KB
-
Filesize
4KB
-
Filesize
2.9MB
-
Filesize
4KB