Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
-
submitted
19/12/2023, 11:24
General
-
Target
137513392ce62dc5e0447a526cd0a19d.exe
-
Size
1.9MB
-
MD5
137513392ce62dc5e0447a526cd0a19d
-
SHA1
858de6cbdcb0bbdb650c80a67f8b6dbf324ae9eb
-
SHA256
8d866a1ca8a8b6af3407ec747540a33659e55bda65d4c5ff71d49b340978a169
-
SHA512
de041d46a828fe452e23ae845d592a77d3d84cd06d357712a9e9920023c8dca6299aa550fab8ad87aca62926426c1f86294004d6e53b77cbec839e17d98bc1a5
-
SSDEEP
49152:Qoa1taC070ddIX2E0Ub7725K9Anj8ZqPjCQcvzNHR:Qoa1taC0ANQ65iA9WnvZx
Score
7/10
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\137513392ce62dc5e0447a526cd0a19d.exe"C:\Users\Admin\AppData\Local\Temp\137513392ce62dc5e0447a526cd0a19d.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\722.tmp"C:\Users\Admin\AppData\Local\Temp\722.tmp" --splashC:\Users\Admin\AppData\Local\Temp\137513392ce62dc5e0447a526cd0a19d.exe 5EBDC4AD472F31E40E9D5546E5B6B72295853B6B0566A3629ED56C1F229CC6DA2AAFD7EDBAE594BF553220D3D4348CA0C9C94B6DF21D37AD05696C30376EFDF52⤵
- Deletes itself
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.9MB
MD588aab0fa0baee7fe215ed7a77c817dd0
SHA15c5c15a926b8076b4c6ddef71e0a00d4aecd7076
SHA256952a751953874c5d731a2227f05a7cd43fcfad35338fe3b9580803c6cb0e45ab
SHA512939a093736aee737243eb692126090f4a53d2c51debc277dbebfa7c01c27ef5f8a135fc38b3160baf69cb99d90edcfa7cc52a39085760ad7fad72cc78025548a
-
Filesize
1.9MB
-
Filesize
1.9MB