Analysis

  • max time kernel
    141s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20230712-en
  • resource tags

    arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
  • submitted
    20/08/2023, 01:29

General

  • Target

    55fe4ee7603acfe95ac3da87f701ad05.exe

  • Size

    18.7MB

  • MD5

    55fe4ee7603acfe95ac3da87f701ad05

  • SHA1

    0a924938d54dad52d00bfe8d4e09cc8fd9c92361

  • SHA256

    7e6c76db8bf23796814972eab33cdb4c1bb6ff7a7a0f705ae847f7ab49e3ea26

  • SHA512

    c82e4506ea5c37c507374a62f0003a88bc4ca686c056fed912c2282096e4a2d62a44cab009dce0be11ce7e3dcf2447c64aee217b3a491549caf0639ec4d39fd4

  • SSDEEP

    393216:hl9zmYU6k4a7b8qTtZHxZyuX9UkrRgBRGDhA/7n94EYD/QyKwriuHUZN/Vgqs7:NzmYHq8YfdXCbRCh2nmEEYWtcw17

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\55fe4ee7603acfe95ac3da87f701ad05.exe
    "C:\Users\Admin\AppData\Local\Temp\55fe4ee7603acfe95ac3da87f701ad05.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2472
    • C:\Users\Admin\AppData\Local\Temp\is-LK3AQ.tmp\55fe4ee7603acfe95ac3da87f701ad05.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-LK3AQ.tmp\55fe4ee7603acfe95ac3da87f701ad05.tmp" /SL5="$80120,19156318,421888,C:\Users\Admin\AppData\Local\Temp\55fe4ee7603acfe95ac3da87f701ad05.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: GetForegroundWindowSpam
      PID:2232

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\is-LK3AQ.tmp\55fe4ee7603acfe95ac3da87f701ad05.tmp

          Filesize

          1.4MB

          MD5

          89ed0cb7a3290a58df3966d987350585

          SHA1

          be9afe9c0690111fd13f0e1cc087f67eed48d676

          SHA256

          a718364dcf9a173a2e671c47e9a8e1570f06aa6a156816b4ec6e3988e54a6037

          SHA512

          2e3434d465cbd56bf14f47f5353af3d8f947100fb19e15f415c6953b0317fe7b402296c3463766e6d795517590e664291b77419763b703ba7623288d72eebe13

        • \Users\Admin\AppData\Local\Temp\is-LK3AQ.tmp\55fe4ee7603acfe95ac3da87f701ad05.tmp

          Filesize

          1.4MB

          MD5

          89ed0cb7a3290a58df3966d987350585

          SHA1

          be9afe9c0690111fd13f0e1cc087f67eed48d676

          SHA256

          a718364dcf9a173a2e671c47e9a8e1570f06aa6a156816b4ec6e3988e54a6037

          SHA512

          2e3434d465cbd56bf14f47f5353af3d8f947100fb19e15f415c6953b0317fe7b402296c3463766e6d795517590e664291b77419763b703ba7623288d72eebe13

        • memory/2232-62-0x0000000000240000-0x0000000000241000-memory.dmp

          Filesize

          4KB

        • memory/2232-66-0x0000000000400000-0x0000000000577000-memory.dmp

          Filesize

          1.5MB

        • memory/2232-67-0x0000000000240000-0x0000000000241000-memory.dmp

          Filesize

          4KB

        • memory/2472-54-0x0000000000400000-0x0000000000471000-memory.dmp

          Filesize

          452KB

        • memory/2472-56-0x0000000000400000-0x0000000000471000-memory.dmp

          Filesize

          452KB

        • memory/2472-64-0x0000000000400000-0x0000000000471000-memory.dmp

          Filesize

          452KB