Overview

overview

7

Static

static

3

d888f02505...92.exe

windows7-x64

7

d888f02505...92.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    142s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231020-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16/11/2023, 10:59

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    d888f02505fb0e08a5950e675c2b5639ed94dcbb07caca7d0132d35ae5bfdd92.exe

  • Size

    816KB

  • MD5

    2ab5eda95f5512f5d541a2a34bef46a0

  • SHA1

    2dd6561705b9556cac9465a20830f391af7c7a33

  • SHA256

    d888f02505fb0e08a5950e675c2b5639ed94dcbb07caca7d0132d35ae5bfdd92

  • SHA512

    8f25067d75e1654e849ee27423aa93fb7e5b19f41e4f00f37b65cc735d6e321752ba77e525561b21b40e17cc41373f71def4bbc355c32bc704804ba43eed7014

  • SSDEEP

    24576:FY4G2qLMJalsnqShyoo77lUabuSvbDQOOdIxJsG90:63XZynV4oDabuWbDQOcIxJJ90

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d888f02505fb0e08a5950e675c2b5639ed94dcbb07caca7d0132d35ae5bfdd92.exe
    "C:\Users\Admin\AppData\Local\Temp\d888f02505fb0e08a5950e675c2b5639ed94dcbb07caca7d0132d35ae5bfdd92.exe"
    1⤵
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious use of WriteProcessMemory
    PID:2096
    • C:\Users\Admin\AppData\Local\Temp\1C0A0C0C120E156B155A15B0C0D160C0A160D.exe
      C:\Users\Admin\AppData\Local\Temp\1C0A0C0C120E156B155A15B0C0D160C0A160D.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      PID:1252

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\1C0A0C0C120E156B155A15B0C0D160C0A160D.exe
          Filesize

          816KB

          MD5

          fa89f0faeba6894ac169a309c30c30a0

          SHA1

          251c8e8a639ce892081d8316d18e82a3a9f7bac0

          SHA256

          9f64f6b12e6ab29c0ec0361d078b9894cbf05d55c1faf23e512d2979b39d2734

          SHA512

          f2446d0656209baf0c89a588875d208581f507269ec1acb9026bc805e73543182f425456c759924ce334a774f052f0b68cfb1a77fcbd37f8e1215bc62034efa2

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\1C0A0C0C120E156B155A15B0C0D160C0A160D.exe
          Filesize

          816KB

          MD5

          fa89f0faeba6894ac169a309c30c30a0

          SHA1

          251c8e8a639ce892081d8316d18e82a3a9f7bac0

          SHA256

          9f64f6b12e6ab29c0ec0361d078b9894cbf05d55c1faf23e512d2979b39d2734

          SHA512

          f2446d0656209baf0c89a588875d208581f507269ec1acb9026bc805e73543182f425456c759924ce334a774f052f0b68cfb1a77fcbd37f8e1215bc62034efa2

          Download Submit

        • memory/1252-9-0x0000000000400000-0x00000000005AD000-memory.dmp

          Filesize

          1.7MB

          Download

        • memory/1252-11-0x0000000000400000-0x00000000005AD000-memory.dmp

          Filesize

          1.7MB

          Download

        • memory/1252-12-0x0000000000400000-0x00000000005AD000-memory.dmp

          Filesize

          1.7MB

          Download

        • memory/2096-0-0x0000000000400000-0x00000000005AD000-memory.dmp

          Filesize

          1.7MB

          Download

        • memory/2096-1-0x0000000000400000-0x00000000005AD000-memory.dmp

          Filesize

          1.7MB

          Download

        • memory/2096-2-0x0000000000400000-0x00000000005AD000-memory.dmp

          Filesize

          1.7MB

          Download

        • memory/2096-8-0x0000000000400000-0x00000000005AD000-memory.dmp

          Filesize

          1.7MB

          Download