Analysis
-
max time kernel
118s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
24/12/2023, 23:15
General
-
Target
18bb2acecc8ec2cb59b3f5e6ab6990aa.exe
-
Size
82KB
-
MD5
18bb2acecc8ec2cb59b3f5e6ab6990aa
-
SHA1
145e9a823d5e40d3f25afb588a9130c15c2ac627
-
SHA256
16ed7390517dccbf6f63be71b00aa54a16fe89ee502e03c84084e16b94156d3b
-
SHA512
041675d8afa37ced1e28401ff68f04e96596b1bd85d49118c8494f591e2d237654563cfd51182d53a5c076a257c578a8f152e7388328df11e9779a9fc44ba2fb
-
SSDEEP
1536:RF8TRARWh4DtA1pdJRfYXoJE2i3d/1pqBm5Xl5emL6IewmKGc1:n8NAnDtKTfY4ax3d//qBmdl5eQdewBGg
Score
7/10
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\18bb2acecc8ec2cb59b3f5e6ab6990aa.exe"C:\Users\Admin\AppData\Local\Temp\18bb2acecc8ec2cb59b3f5e6ab6990aa.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\18bb2acecc8ec2cb59b3f5e6ab6990aa.exeC:\Users\Admin\AppData\Local\Temp\18bb2acecc8ec2cb59b3f5e6ab6990aa.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
82KB
MD5c38e0118f7af8ee225962cc7c5d87f92
SHA1cadbe0822f17c0bc8b2e58fc876c8a5fe25a3816
SHA256e320c04312f5e14563a628c970d5374fc88aa663aa61352e18eccb64b81e16a2
SHA5128f97534a0a54592497b2c188c0856d2322725aa3d2aab618fed76c49b5493697abaab4ebb48f7153268111a7c2a3bfa02a8a0b471023e6c440e40837f869572b
-
Filesize
188KB
-
Filesize
188KB
-
Filesize
108KB
-
Filesize
188KB
-
Filesize
108KB
-
Filesize
188KB
-
Filesize
188KB
-
Filesize
56KB
-
Filesize
108KB