Analysis
-
max time kernel
142s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
24-12-2023 09:39
General
-
Target
sublime_text_build_4169_x64_setup.exe
-
Size
15.7MB
-
MD5
591561a993ef58f8c547f1542c1ed2d8
-
SHA1
1177c6451fdaa841f7a8cb0feed53b6621e3356d
-
SHA256
7f8a7557d92ed985e26d9f0bfefa7d2dec72ee38e28579aca86fcb1114e4c267
-
SHA512
4902149980eebfdd8720600002d181816d8b36292fd8b5af5a023928738aa30789b3ee3c1075f304b55f4809b2df5dc63fa453e8747672064475e07478829089
-
SSDEEP
393216:fXI2GZeymKWixJkWwmP7o/OVHLBL5Y7rFQD0t1/26tTK:f4NoymKPQOVHLBLG9+wN1t
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\sublime_text_build_4169_x64_setup.exe"C:\Users\Admin\AppData\Local\Temp\sublime_text_build_4169_x64_setup.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-C0VP1.tmp\sublime_text_build_4169_x64_setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-C0VP1.tmp\sublime_text_build_4169_x64_setup.tmp" /SL5="$80152,16071622,121344,C:\Users\Admin\AppData\Local\Temp\sublime_text_build_4169_x64_setup.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.1MB
MD58f7da348d1de78061ff3923fc50a24d5
SHA1117257f0ad968f65c3a51010ffce82fae9411fb0
SHA2565f417318ca2e2b98b9b781106fd9fbb64e959685ca697e017c4365c449baa7ce
SHA51252552bced567566ffe4210cb6ddd27a1f7482559c7574bde0607ce22ae9980b57794cb3d0c4cee63768f69cc9b16336c2540141ff99e57e9c5c33cfc21ff602c
-
Filesize
160KB
-
Filesize
160KB
-
Filesize
160KB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
4KB