Overview

overview

7

Static

static

3

aed5c1a4dd...8d.exe

windows7-x64

7

aed5c1a4dd...8d.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    141s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30-08-2023 22:00

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    aed5c1a4dd6fedb5213925a777e0c05df1d06f4eaf7b2a2534c70e507f15fb8d.exe

  • Size

    812KB

  • MD5

    954bfaa2aab7afeaa5e76dc02c8aed9b

  • SHA1

    1ce979c3d8893edff1ba3d11d9509806385582c7

  • SHA256

    aed5c1a4dd6fedb5213925a777e0c05df1d06f4eaf7b2a2534c70e507f15fb8d

  • SHA512

    c3cbb443b548c8f2092270008ca2652e5b12c2017cb4a9a7f01c1bae4a743768aa80accc8fd1cb0aa19099cefcabfca4953236856a546376c47fb17937380b03

  • SSDEEP

    12288:WqmytVdB0rPEDb3kCoI641jxy7GHEX2rnAv8MktrOKxp22CMOZ/1Sq:WqxtVfNDb31oT41+aneOrO4p2zMOZ/V

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\aed5c1a4dd6fedb5213925a777e0c05df1d06f4eaf7b2a2534c70e507f15fb8d.exe
    "C:\Users\Admin\AppData\Local\Temp\aed5c1a4dd6fedb5213925a777e0c05df1d06f4eaf7b2a2534c70e507f15fb8d.exe"
    1⤵
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious use of WriteProcessMemory
    PID:1640
    • C:\Users\Admin\AppData\Local\Temp\1F0D0B0F120C156B155B15D0F0A160F0D160E.exe
      C:\Users\Admin\AppData\Local\Temp\1F0D0B0F120C156B155B15D0F0A160F0D160E.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      PID:1260

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\1F0D0B0F120C156B155B15D0F0A160F0D160E.exe
    Filesize

    812KB

    MD5

    8e3312525e4c60827c88693713924ec9

    SHA1

    a7b00f4a47ccb87ca042785990655e63db1cedd4

    SHA256

    75df7351b94aa9aa9fa56073a1cf27e6e37e173e6b0f38400b9cf2226ed5a43a

    SHA512

    99f7aa9ee431e94d863f9dd474744b838486e1fc5ff01cd934957e5d6fd32f0a315da6c3eae0af5c2991e8e66bcba7aefe19b6d571555c286ee44ecee04d0284

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\1F0D0B0F120C156B155B15D0F0A160F0D160E.exe
    Filesize

    812KB

    MD5

    8e3312525e4c60827c88693713924ec9

    SHA1

    a7b00f4a47ccb87ca042785990655e63db1cedd4

    SHA256

    75df7351b94aa9aa9fa56073a1cf27e6e37e173e6b0f38400b9cf2226ed5a43a

    SHA512

    99f7aa9ee431e94d863f9dd474744b838486e1fc5ff01cd934957e5d6fd32f0a315da6c3eae0af5c2991e8e66bcba7aefe19b6d571555c286ee44ecee04d0284

    Download Submit

  • memory/1260-9-0x0000000000400000-0x00000000005AB000-memory.dmp

    Filesize

    1.7MB

    Download

  • memory/1260-11-0x0000000000400000-0x00000000005AB000-memory.dmp

    Filesize

    1.7MB

    Download

  • memory/1260-12-0x0000000000400000-0x00000000005AB000-memory.dmp

    Filesize

    1.7MB

    Download

  • memory/1640-0-0x0000000000400000-0x00000000005AB000-memory.dmp

    Filesize

    1.7MB

    Download

  • memory/1640-2-0x0000000000400000-0x00000000005AB000-memory.dmp

    Filesize

    1.7MB

    Download

  • memory/1640-8-0x0000000000400000-0x00000000005AB000-memory.dmp

    Filesize

    1.7MB

    Download