Analysis
-
max time kernel
141s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
20/08/2023, 01:29
Static task
static1
Behavioral task
behavioral1
Sample
55fe4ee7603acfe95ac3da87f701ad05.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
55fe4ee7603acfe95ac3da87f701ad05.exe
Resource
win10v2004-20230703-en
General
-
Target
55fe4ee7603acfe95ac3da87f701ad05.exe
-
Size
18.7MB
-
MD5
55fe4ee7603acfe95ac3da87f701ad05
-
SHA1
0a924938d54dad52d00bfe8d4e09cc8fd9c92361
-
SHA256
7e6c76db8bf23796814972eab33cdb4c1bb6ff7a7a0f705ae847f7ab49e3ea26
-
SHA512
c82e4506ea5c37c507374a62f0003a88bc4ca686c056fed912c2282096e4a2d62a44cab009dce0be11ce7e3dcf2447c64aee217b3a491549caf0639ec4d39fd4
-
SSDEEP
393216:hl9zmYU6k4a7b8qTtZHxZyuX9UkrRgBRGDhA/7n94EYD/QyKwriuHUZN/Vgqs7:NzmYHq8YfdXCbRCh2nmEEYWtcw17
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2232 55fe4ee7603acfe95ac3da87f701ad05.tmp -
Loads dropped DLL 1 IoCs
pid Process 2472 55fe4ee7603acfe95ac3da87f701ad05.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2232 55fe4ee7603acfe95ac3da87f701ad05.tmp -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2472 wrote to memory of 2232 2472 55fe4ee7603acfe95ac3da87f701ad05.exe 28 PID 2472 wrote to memory of 2232 2472 55fe4ee7603acfe95ac3da87f701ad05.exe 28 PID 2472 wrote to memory of 2232 2472 55fe4ee7603acfe95ac3da87f701ad05.exe 28 PID 2472 wrote to memory of 2232 2472 55fe4ee7603acfe95ac3da87f701ad05.exe 28 PID 2472 wrote to memory of 2232 2472 55fe4ee7603acfe95ac3da87f701ad05.exe 28 PID 2472 wrote to memory of 2232 2472 55fe4ee7603acfe95ac3da87f701ad05.exe 28 PID 2472 wrote to memory of 2232 2472 55fe4ee7603acfe95ac3da87f701ad05.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\55fe4ee7603acfe95ac3da87f701ad05.exe"C:\Users\Admin\AppData\Local\Temp\55fe4ee7603acfe95ac3da87f701ad05.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2472 -
C:\Users\Admin\AppData\Local\Temp\is-LK3AQ.tmp\55fe4ee7603acfe95ac3da87f701ad05.tmp"C:\Users\Admin\AppData\Local\Temp\is-LK3AQ.tmp\55fe4ee7603acfe95ac3da87f701ad05.tmp" /SL5="$80120,19156318,421888,C:\Users\Admin\AppData\Local\Temp\55fe4ee7603acfe95ac3da87f701ad05.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
PID:2232
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.4MB
MD589ed0cb7a3290a58df3966d987350585
SHA1be9afe9c0690111fd13f0e1cc087f67eed48d676
SHA256a718364dcf9a173a2e671c47e9a8e1570f06aa6a156816b4ec6e3988e54a6037
SHA5122e3434d465cbd56bf14f47f5353af3d8f947100fb19e15f415c6953b0317fe7b402296c3463766e6d795517590e664291b77419763b703ba7623288d72eebe13
-
Filesize
1.4MB
MD589ed0cb7a3290a58df3966d987350585
SHA1be9afe9c0690111fd13f0e1cc087f67eed48d676
SHA256a718364dcf9a173a2e671c47e9a8e1570f06aa6a156816b4ec6e3988e54a6037
SHA5122e3434d465cbd56bf14f47f5353af3d8f947100fb19e15f415c6953b0317fe7b402296c3463766e6d795517590e664291b77419763b703ba7623288d72eebe13