Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
25/08/2023, 08:57
Static task
static1
Behavioral task
behavioral1
Sample
dcab1a2e05fabbb38ebbce704e302bfe120c1a3fe7416c617b381e41f0f5cae6.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
dcab1a2e05fabbb38ebbce704e302bfe120c1a3fe7416c617b381e41f0f5cae6.exe
Resource
win10v2004-20230824-en
General
-
Target
dcab1a2e05fabbb38ebbce704e302bfe120c1a3fe7416c617b381e41f0f5cae6.exe
-
Size
2.6MB
-
MD5
298133d0c7993930c9b1e182710d65b4
-
SHA1
0e9d9df83bd9ff1c5077392ec2939e28fae80152
-
SHA256
dcab1a2e05fabbb38ebbce704e302bfe120c1a3fe7416c617b381e41f0f5cae6
-
SHA512
b11af10280928eb33544fce1f6a3edb4b3114225bb20d0a8f4d6a83a9d5ca5d7457509637cf31817608319a778a7221f921185eca6683ba4eaa0a4220d341679
-
SSDEEP
49152:dlpWTUNJsERkalo0uLTgwEH4s8bZdTW2kcq6Mtqs64YPftmwq:vpWYaERkaLwYVidPOZgdmF
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2868 dcab1a2e05fabbb38ebbce704e302bfe120c1a3fe7416c617b381e41f0f5cae6.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2868 dcab1a2e05fabbb38ebbce704e302bfe120c1a3fe7416c617b381e41f0f5cae6.exe 2868 dcab1a2e05fabbb38ebbce704e302bfe120c1a3fe7416c617b381e41f0f5cae6.exe 2868 dcab1a2e05fabbb38ebbce704e302bfe120c1a3fe7416c617b381e41f0f5cae6.exe 2868 dcab1a2e05fabbb38ebbce704e302bfe120c1a3fe7416c617b381e41f0f5cae6.exe 2868 dcab1a2e05fabbb38ebbce704e302bfe120c1a3fe7416c617b381e41f0f5cae6.exe 2868 dcab1a2e05fabbb38ebbce704e302bfe120c1a3fe7416c617b381e41f0f5cae6.exe 2868 dcab1a2e05fabbb38ebbce704e302bfe120c1a3fe7416c617b381e41f0f5cae6.exe 2868 dcab1a2e05fabbb38ebbce704e302bfe120c1a3fe7416c617b381e41f0f5cae6.exe 2868 dcab1a2e05fabbb38ebbce704e302bfe120c1a3fe7416c617b381e41f0f5cae6.exe 2868 dcab1a2e05fabbb38ebbce704e302bfe120c1a3fe7416c617b381e41f0f5cae6.exe 2868 dcab1a2e05fabbb38ebbce704e302bfe120c1a3fe7416c617b381e41f0f5cae6.exe 2868 dcab1a2e05fabbb38ebbce704e302bfe120c1a3fe7416c617b381e41f0f5cae6.exe 2868 dcab1a2e05fabbb38ebbce704e302bfe120c1a3fe7416c617b381e41f0f5cae6.exe 2868 dcab1a2e05fabbb38ebbce704e302bfe120c1a3fe7416c617b381e41f0f5cae6.exe 2868 dcab1a2e05fabbb38ebbce704e302bfe120c1a3fe7416c617b381e41f0f5cae6.exe 2868 dcab1a2e05fabbb38ebbce704e302bfe120c1a3fe7416c617b381e41f0f5cae6.exe 2868 dcab1a2e05fabbb38ebbce704e302bfe120c1a3fe7416c617b381e41f0f5cae6.exe 2868 dcab1a2e05fabbb38ebbce704e302bfe120c1a3fe7416c617b381e41f0f5cae6.exe 2868 dcab1a2e05fabbb38ebbce704e302bfe120c1a3fe7416c617b381e41f0f5cae6.exe 2868 dcab1a2e05fabbb38ebbce704e302bfe120c1a3fe7416c617b381e41f0f5cae6.exe 2868 dcab1a2e05fabbb38ebbce704e302bfe120c1a3fe7416c617b381e41f0f5cae6.exe 2868 dcab1a2e05fabbb38ebbce704e302bfe120c1a3fe7416c617b381e41f0f5cae6.exe 2868 dcab1a2e05fabbb38ebbce704e302bfe120c1a3fe7416c617b381e41f0f5cae6.exe 2868 dcab1a2e05fabbb38ebbce704e302bfe120c1a3fe7416c617b381e41f0f5cae6.exe 2868 dcab1a2e05fabbb38ebbce704e302bfe120c1a3fe7416c617b381e41f0f5cae6.exe 2868 dcab1a2e05fabbb38ebbce704e302bfe120c1a3fe7416c617b381e41f0f5cae6.exe 2868 dcab1a2e05fabbb38ebbce704e302bfe120c1a3fe7416c617b381e41f0f5cae6.exe 2868 dcab1a2e05fabbb38ebbce704e302bfe120c1a3fe7416c617b381e41f0f5cae6.exe 2868 dcab1a2e05fabbb38ebbce704e302bfe120c1a3fe7416c617b381e41f0f5cae6.exe 2868 dcab1a2e05fabbb38ebbce704e302bfe120c1a3fe7416c617b381e41f0f5cae6.exe 2868 dcab1a2e05fabbb38ebbce704e302bfe120c1a3fe7416c617b381e41f0f5cae6.exe 2868 dcab1a2e05fabbb38ebbce704e302bfe120c1a3fe7416c617b381e41f0f5cae6.exe 2868 dcab1a2e05fabbb38ebbce704e302bfe120c1a3fe7416c617b381e41f0f5cae6.exe 2868 dcab1a2e05fabbb38ebbce704e302bfe120c1a3fe7416c617b381e41f0f5cae6.exe 2868 dcab1a2e05fabbb38ebbce704e302bfe120c1a3fe7416c617b381e41f0f5cae6.exe 2868 dcab1a2e05fabbb38ebbce704e302bfe120c1a3fe7416c617b381e41f0f5cae6.exe 2868 dcab1a2e05fabbb38ebbce704e302bfe120c1a3fe7416c617b381e41f0f5cae6.exe 2868 dcab1a2e05fabbb38ebbce704e302bfe120c1a3fe7416c617b381e41f0f5cae6.exe 2868 dcab1a2e05fabbb38ebbce704e302bfe120c1a3fe7416c617b381e41f0f5cae6.exe 2868 dcab1a2e05fabbb38ebbce704e302bfe120c1a3fe7416c617b381e41f0f5cae6.exe 2868 dcab1a2e05fabbb38ebbce704e302bfe120c1a3fe7416c617b381e41f0f5cae6.exe 2868 dcab1a2e05fabbb38ebbce704e302bfe120c1a3fe7416c617b381e41f0f5cae6.exe 2868 dcab1a2e05fabbb38ebbce704e302bfe120c1a3fe7416c617b381e41f0f5cae6.exe 2868 dcab1a2e05fabbb38ebbce704e302bfe120c1a3fe7416c617b381e41f0f5cae6.exe 2868 dcab1a2e05fabbb38ebbce704e302bfe120c1a3fe7416c617b381e41f0f5cae6.exe 2868 dcab1a2e05fabbb38ebbce704e302bfe120c1a3fe7416c617b381e41f0f5cae6.exe 2868 dcab1a2e05fabbb38ebbce704e302bfe120c1a3fe7416c617b381e41f0f5cae6.exe 2868 dcab1a2e05fabbb38ebbce704e302bfe120c1a3fe7416c617b381e41f0f5cae6.exe 2868 dcab1a2e05fabbb38ebbce704e302bfe120c1a3fe7416c617b381e41f0f5cae6.exe 2868 dcab1a2e05fabbb38ebbce704e302bfe120c1a3fe7416c617b381e41f0f5cae6.exe 2868 dcab1a2e05fabbb38ebbce704e302bfe120c1a3fe7416c617b381e41f0f5cae6.exe 2868 dcab1a2e05fabbb38ebbce704e302bfe120c1a3fe7416c617b381e41f0f5cae6.exe 2868 dcab1a2e05fabbb38ebbce704e302bfe120c1a3fe7416c617b381e41f0f5cae6.exe 2868 dcab1a2e05fabbb38ebbce704e302bfe120c1a3fe7416c617b381e41f0f5cae6.exe 2868 dcab1a2e05fabbb38ebbce704e302bfe120c1a3fe7416c617b381e41f0f5cae6.exe 2868 dcab1a2e05fabbb38ebbce704e302bfe120c1a3fe7416c617b381e41f0f5cae6.exe 2868 dcab1a2e05fabbb38ebbce704e302bfe120c1a3fe7416c617b381e41f0f5cae6.exe 2868 dcab1a2e05fabbb38ebbce704e302bfe120c1a3fe7416c617b381e41f0f5cae6.exe 2868 dcab1a2e05fabbb38ebbce704e302bfe120c1a3fe7416c617b381e41f0f5cae6.exe 2868 dcab1a2e05fabbb38ebbce704e302bfe120c1a3fe7416c617b381e41f0f5cae6.exe 2868 dcab1a2e05fabbb38ebbce704e302bfe120c1a3fe7416c617b381e41f0f5cae6.exe 2868 dcab1a2e05fabbb38ebbce704e302bfe120c1a3fe7416c617b381e41f0f5cae6.exe 2868 dcab1a2e05fabbb38ebbce704e302bfe120c1a3fe7416c617b381e41f0f5cae6.exe 2868 dcab1a2e05fabbb38ebbce704e302bfe120c1a3fe7416c617b381e41f0f5cae6.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2512 wrote to memory of 2868 2512 dcab1a2e05fabbb38ebbce704e302bfe120c1a3fe7416c617b381e41f0f5cae6.exe 28 PID 2512 wrote to memory of 2868 2512 dcab1a2e05fabbb38ebbce704e302bfe120c1a3fe7416c617b381e41f0f5cae6.exe 28 PID 2512 wrote to memory of 2868 2512 dcab1a2e05fabbb38ebbce704e302bfe120c1a3fe7416c617b381e41f0f5cae6.exe 28 PID 2512 wrote to memory of 2868 2512 dcab1a2e05fabbb38ebbce704e302bfe120c1a3fe7416c617b381e41f0f5cae6.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\dcab1a2e05fabbb38ebbce704e302bfe120c1a3fe7416c617b381e41f0f5cae6.exe"C:\Users\Admin\AppData\Local\Temp\dcab1a2e05fabbb38ebbce704e302bfe120c1a3fe7416c617b381e41f0f5cae6.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2512 -
F:\dcab1a2e05fabbb38ebbce704e302bfe120c1a3fe7416c617b381e41f0f5cae6.exe"F:\dcab1a2e05fabbb38ebbce704e302bfe120c1a3fe7416c617b381e41f0f5cae6.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2868
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.6MB
MD5298133d0c7993930c9b1e182710d65b4
SHA10e9d9df83bd9ff1c5077392ec2939e28fae80152
SHA256dcab1a2e05fabbb38ebbce704e302bfe120c1a3fe7416c617b381e41f0f5cae6
SHA512b11af10280928eb33544fce1f6a3edb4b3114225bb20d0a8f4d6a83a9d5ca5d7457509637cf31817608319a778a7221f921185eca6683ba4eaa0a4220d341679