Overview

overview

7

Static

static

3

9fa652338e...b3.exe

windows7-x64

7

9fa652338e...b3.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    93s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22/12/2023, 13:20

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    9fa652338e6a8bf681191de1580720b3.exe

  • Size

    3.3MB

  • MD5

    9fa652338e6a8bf681191de1580720b3

  • SHA1

    8332dd3782ecd1079d47f62359a42cc86c182a11

  • SHA256

    7f5268becaff1ac01fbd1e04fa8c2d871e4fbe07ef375144cb59c150182f0a5b

  • SHA512

    16bc611709c225bd61d4be740b628b1ca22a37224a520a10c793cfde4e74318f7cf6d74dcccb257004c04b378876d3cfc23c55c7ab9d7b511515f3725991b177

  • SSDEEP

    98304:pZQAZauDurqjG8JpA2Fnf+RBj5NCj+y9ut26:j35Dkqvwof+RZTCymo/

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\9fa652338e6a8bf681191de1580720b3.exe
    "C:\Users\Admin\AppData\Local\Temp\9fa652338e6a8bf681191de1580720b3.exe"
    1⤵
    • Suspicious behavior: RenamesItself
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:1728
    • C:\Users\Admin\AppData\Local\Temp\9fa652338e6a8bf681191de1580720b3.exe
      C:\Users\Admin\AppData\Local\Temp\9fa652338e6a8bf681191de1580720b3.exe
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Suspicious use of UnmapMainImage
      PID:1524

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\9fa652338e6a8bf681191de1580720b3.exe
          Filesize

          412KB

          MD5

          8901d2484ce807cf24c1caf7b767dcb9

          SHA1

          3c56a959f0deaa8cd8cb62b6d3f3c39613bab72e

          SHA256

          f544ad5a1f62d7389d60ffe8fda135c82a82938eb623927a7b9223c053178cbf

          SHA512

          73d0d2a0b9907aba3a726a20d279c1ee770421a0b3fd501418e345bc436169ecb4891f9320beeb5ad8e36326efa51729eb0bd85dfdbc9e80e960748c612bedae

          Download Submit

        • memory/1524-13-0x0000000000400000-0x0000000000877000-memory.dmp

          Filesize

          4.5MB

          Download

        • memory/1524-14-0x0000000000400000-0x000000000064D000-memory.dmp

          Filesize

          2.3MB

          Download

        • memory/1524-15-0x0000000001C30000-0x00000000020A7000-memory.dmp

          Filesize

          4.5MB

          Download

        • memory/1524-21-0x0000000000400000-0x0000000000640000-memory.dmp

          Filesize

          2.2MB

          Download

        • memory/1524-20-0x0000000005900000-0x0000000005B4D000-memory.dmp

          Filesize

          2.3MB

          Download

        • memory/1728-0-0x0000000000400000-0x0000000000877000-memory.dmp

          Filesize

          4.5MB

          Download

        • memory/1728-1-0x0000000001CC0000-0x0000000002137000-memory.dmp

          Filesize

          4.5MB

          Download

        • memory/1728-2-0x0000000000400000-0x000000000064D000-memory.dmp

          Filesize

          2.3MB

          Download

        • memory/1728-11-0x0000000000400000-0x000000000064D000-memory.dmp

          Filesize

          2.3MB

          Download