Analysis
-
max time kernel
122s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
04/08/2023, 20:46
Behavioral task
behavioral1
Sample
fi30mtm7384bj.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
fi30mtm7384bj.exe
Resource
win10v2004-20230703-en
General
-
Target
fi30mtm7384bj.exe
-
Size
6.6MB
-
MD5
aec2444fff7f041129caeba95f5c0cd8
-
SHA1
541ec892c01311d4ecb5bd00e94fcb1292923c8f
-
SHA256
c57150dd70cf2780decee027a2dfac8e01a698f219ef3397d8706a100a1d854a
-
SHA512
9b0c02ac8420e5517669040a8260d27913b2197a4546b2b6910084a5318be5fad2d967a30526f22474fb30556cceaa7fed4ec7042ac3dff093f68ad11eb857a6
-
SSDEEP
98304:U5zTX4Pf1N2zIh3ET9Y9MxVMOPUh3PdWPEUrJY6AOxbHPS2zh/hQqfvsJ1YPwIu/:UVX4FMIZETKwjPePdrQJ/BNOqAYPL
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 1124 fi30mtm7384bj.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1152 wrote to memory of 1124 1152 fi30mtm7384bj.exe 28 PID 1152 wrote to memory of 1124 1152 fi30mtm7384bj.exe 28 PID 1152 wrote to memory of 1124 1152 fi30mtm7384bj.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\fi30mtm7384bj.exe"C:\Users\Admin\AppData\Local\Temp\fi30mtm7384bj.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1152 -
C:\Users\Admin\AppData\Local\Temp\fi30mtm7384bj.exe"C:\Users\Admin\AppData\Local\Temp\fi30mtm7384bj.exe"2⤵
- Loads dropped DLL
PID:1124
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.5MB
MD55a5dd7cad8028097842b0afef45bfbcf
SHA1e247a2e460687c607253949c52ae2801ff35dc4a
SHA256a811c7516f531f1515d10743ae78004dd627eba0dc2d3bc0d2e033b2722043ce
SHA512e6268e4fad2ce3ef16b68298a57498e16f0262bf3531539ad013a66f72df471569f94c6fcc48154b7c3049a3ad15cbfcbb6345dacb4f4ed7d528c74d589c9858
-
Filesize
5.5MB
MD55a5dd7cad8028097842b0afef45bfbcf
SHA1e247a2e460687c607253949c52ae2801ff35dc4a
SHA256a811c7516f531f1515d10743ae78004dd627eba0dc2d3bc0d2e033b2722043ce
SHA512e6268e4fad2ce3ef16b68298a57498e16f0262bf3531539ad013a66f72df471569f94c6fcc48154b7c3049a3ad15cbfcbb6345dacb4f4ed7d528c74d589c9858