Analysis

  • max time kernel
    143s
  • max time network
    125s
  • platform
    windows7_x64
  • resource
    win7-20230712-en
  • resource tags

    arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
  • submitted
    18/07/2023, 01:39

General

  • Target

    53eea8664d54198e1989301b12f795da.exe

  • Size

    112.3MB

  • MD5

    53eea8664d54198e1989301b12f795da

  • SHA1

    00bddca8bba387a76d6f18fc942859acf9ff5a60

  • SHA256

    a7c997ba3c3e91c048f80f96f08754948428f6d3fe4001bab79c4ae09d06c5e0

  • SHA512

    e05bd2e369b19b818f715a14ceb2c35b2f8409e5524d347d3093ef82667675bf719af17ab77412156aa62748aa17572d622b163bb6d187d917282f49e56ff831

  • SSDEEP

    3145728:kNS0yY1k/bQS8yJQZI3XeKBPKi2O3hE4AGzUVeQgnFV:koqcQ+3XHD2OxEfPQQgnFV

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\53eea8664d54198e1989301b12f795da.exe
    "C:\Users\Admin\AppData\Local\Temp\53eea8664d54198e1989301b12f795da.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2532
    • C:\Users\Admin\AppData\Local\Temp\is-FP0V0.tmp\53eea8664d54198e1989301b12f795da.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-FP0V0.tmp\53eea8664d54198e1989301b12f795da.tmp" /SL5="$9001C,115841256,1202688,C:\Users\Admin\AppData\Local\Temp\53eea8664d54198e1989301b12f795da.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: GetForegroundWindowSpam
      PID:2332

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\is-FP0V0.tmp\53eea8664d54198e1989301b12f795da.tmp

          Filesize

          3.4MB

          MD5

          07b96c2d1823a0a548832c1062799d85

          SHA1

          65a35826b0e6d93700256fd8a4710cc039bd7b8d

          SHA256

          c5ba29e4c82fca9adfcd3a6b60b3bf786abe7178928f80cb60eca3564e35b3de

          SHA512

          abf2ba63976bd6622f3a1cda816c8f2267b59c079d6092ff60e7f52be893a993e3b457a174092c74056628e9694fa9efc8d823d14b4d658a9eb59c622d992f65

        • \Users\Admin\AppData\Local\Temp\is-FP0V0.tmp\53eea8664d54198e1989301b12f795da.tmp

          Filesize

          3.4MB

          MD5

          07b96c2d1823a0a548832c1062799d85

          SHA1

          65a35826b0e6d93700256fd8a4710cc039bd7b8d

          SHA256

          c5ba29e4c82fca9adfcd3a6b60b3bf786abe7178928f80cb60eca3564e35b3de

          SHA512

          abf2ba63976bd6622f3a1cda816c8f2267b59c079d6092ff60e7f52be893a993e3b457a174092c74056628e9694fa9efc8d823d14b4d658a9eb59c622d992f65

        • memory/2332-62-0x0000000000240000-0x0000000000241000-memory.dmp

          Filesize

          4KB

        • memory/2332-66-0x0000000000400000-0x0000000000776000-memory.dmp

          Filesize

          3.5MB

        • memory/2332-67-0x0000000000240000-0x0000000000241000-memory.dmp

          Filesize

          4KB

        • memory/2532-55-0x0000000000400000-0x0000000000533000-memory.dmp

          Filesize

          1.2MB

        • memory/2532-64-0x0000000000400000-0x0000000000533000-memory.dmp

          Filesize

          1.2MB