Analysis
- max time kernel
156s - max time network
156s - platform
windows10-2004_x64 - resource
win10v2004-20230915-en - resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system - submitted
12/10/2023, 07:46
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
bd0d59a8b7761e783ac48e7b8b8012e7debf5504069fc369d82f5420f352c166.exe
Resource
win7-20230831-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
bd0d59a8b7761e783ac48e7b8b8012e7debf5504069fc369d82f5420f352c166.exe
Resource
win10v2004-20230915-en
2 signatures
150 seconds
General
- Target bd0d59a8b7761e783ac48e7b8b8012e7debf5504069fc369d82f5420f352c166.exe
- Size 13.7MB
- Sample231012-jl2cksgg92
- SHA256 bd0d59a8b7761e783ac48e7b8b8012e7debf5504069fc369d82f5420f352c166
- MD5 fdc8a5847a5f8190c3185106bb23d963
- SHA1 d78554988209b275f16c6d5f3da1650f6ba50adb
- SHA512 0d35e8bb9cdfdb90e914de84078c68c2b82160574c58ac592dfb649f33c1e62f2f696c293acd5e5daf6809d13618e2a14c78e2383504ab36136796f14954e2fb
- SSDEEP 393216:6ArNdqUzb8KDkHI+zQYKTvtcq0MCcIqyMr8fc4geRW3mgGA:6m7qHcko+8YYcTcIHHlyGA
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 3184 bd0d59a8b7761e783ac48e7b8b8012e7debf5504069fc369d82f5420f352c166.tmp - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1136 wrote to memory of 3184 1136 bd0d59a8b7761e783ac48e7b8b8012e7debf5504069fc369d82f5420f352c166.exe 86 PID 1136 wrote to memory of 3184 1136 bd0d59a8b7761e783ac48e7b8b8012e7debf5504069fc369d82f5420f352c166.exe 86 PID 1136 wrote to memory of 3184 1136 bd0d59a8b7761e783ac48e7b8b8012e7debf5504069fc369d82f5420f352c166.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\bd0d59a8b7761e783ac48e7b8b8012e7debf5504069fc369d82f5420f352c166.exe"C:\Users\Admin\AppData\Local\Temp\bd0d59a8b7761e783ac48e7b8b8012e7debf5504069fc369d82f5420f352c166.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1136 -
C:\Users\Admin\AppData\Local\Temp\is-RL9P1.tmp\bd0d59a8b7761e783ac48e7b8b8012e7debf5504069fc369d82f5420f352c166.tmp"C:\Users\Admin\AppData\Local\Temp\is-RL9P1.tmp\bd0d59a8b7761e783ac48e7b8b8012e7debf5504069fc369d82f5420f352c166.tmp" /SL5="$A011C,13511514,785920,C:\Users\Admin\AppData\Local\Temp\bd0d59a8b7761e783ac48e7b8b8012e7debf5504069fc369d82f5420f352c166.exe"2⤵
- Executes dropped EXE
PID:3184
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\is-RL9P1.tmp\bd0d59a8b7761e783ac48e7b8b8012e7debf5504069fc369d82f5420f352c166.tmp
- Size 3.0MB
- SHA256 3b5b2d339db4418536f4bb1ddbf5f030dabfd6213f527697ddb0a155cff3bc96
- MD5 86edf13e840a2d2bf4d0f5439232c570
- SHA1 f2c83b8d5bf0700f0baa6c1cd1af1f59ec6ec26c
- SHA512 73adbc48a16b6b9cd0fedc8857f30cdef96931e8eb1c188eb7b68539bf4fa1598de0e1aae183df06be9b4f8e306cd10f961b89308fb4b01efa599170cb646211
- SSDEEP 49152:5dx4HDQNJL0VR6SgMt+k4RiP+RmXMjiINiMq95FoHVHNTQTEjC333O3:KHDYsqiPRhINnq95FoHVBC3332
- MD5 SHA1 SHA512 SSDEEP