Overview

overview

7

Static

static

3

1f02cd9878...9d.exe

windows7-x64

7

1f02cd9878...9d.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    142s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231020-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14/11/2023, 15:57

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    1f02cd987820c0a3efbfaa6353aaf0f00d946f6640125748df4605f38227869d.exe

  • Size

    816KB

  • MD5

    3e9c203e823c119306d8b8fd41187af6

  • SHA1

    191ff77af353fdb2c7ac2f16fc88ed711c21f47c

  • SHA256

    1f02cd987820c0a3efbfaa6353aaf0f00d946f6640125748df4605f38227869d

  • SHA512

    8245c5ce14bf4b076e075eb3841309ed2f28f4303079aaa12daf324fe8155b4fc0776e048e907913c9a3779ee6acd30cb4fa35f8de6e64998499fd87c0063d99

  • SSDEEP

    24576:aY4G2qLMJalsnqShyoo77lUabuSvbDQOOdIxJsG9+:T3XZynV4oDabuWbDQOcIxJJ9+

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1f02cd987820c0a3efbfaa6353aaf0f00d946f6640125748df4605f38227869d.exe
    "C:\Users\Admin\AppData\Local\Temp\1f02cd987820c0a3efbfaa6353aaf0f00d946f6640125748df4605f38227869d.exe"
    1⤵
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious use of WriteProcessMemory
    PID:4084
    • C:\Users\Admin\AppData\Local\Temp\1C0A0B0D120C156A155D15D0E0B160E0D160F.exe
      C:\Users\Admin\AppData\Local\Temp\1C0A0B0D120C156A155D15D0E0B160E0D160F.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      PID:4380

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\1C0A0B0D120C156A155D15D0E0B160E0D160F.exe
          Filesize

          816KB

          MD5

          916f09e38a8a991dc8df65ce637d4116

          SHA1

          ab2180646e5ad6a71fee3b0def3633143b11c630

          SHA256

          b256d982934bd1ea10c7a000314b9383af9da0cb7aedb256951d3d7ab28cbcf0

          SHA512

          210b5736ac41d5d569ad83bcb4e839fa0e6046a30b38ad97759263c887e6340d3ae92c381b47d86370e3c1ee40d1f6f7c9bd4130f72313d41d10eb5553f53c64

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\1C0A0B0D120C156A155D15D0E0B160E0D160F.exe
          Filesize

          816KB

          MD5

          916f09e38a8a991dc8df65ce637d4116

          SHA1

          ab2180646e5ad6a71fee3b0def3633143b11c630

          SHA256

          b256d982934bd1ea10c7a000314b9383af9da0cb7aedb256951d3d7ab28cbcf0

          SHA512

          210b5736ac41d5d569ad83bcb4e839fa0e6046a30b38ad97759263c887e6340d3ae92c381b47d86370e3c1ee40d1f6f7c9bd4130f72313d41d10eb5553f53c64

          Download Submit

        • memory/4084-0-0x0000000000400000-0x00000000005AD000-memory.dmp

          Filesize

          1.7MB

          Download

        • memory/4084-2-0x0000000000400000-0x00000000005AD000-memory.dmp

          Filesize

          1.7MB

          Download

        • memory/4084-8-0x0000000000400000-0x00000000005AD000-memory.dmp

          Filesize

          1.7MB

          Download

        • memory/4380-10-0x0000000000400000-0x00000000005AD000-memory.dmp

          Filesize

          1.7MB

          Download

        • memory/4380-11-0x0000000000400000-0x00000000005AD000-memory.dmp

          Filesize

          1.7MB

          Download

        • memory/4380-9-0x0000000000400000-0x00000000005AD000-memory.dmp

          Filesize

          1.7MB

          Download