Analysis
-
max time kernel
148s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
25-12-2023 05:44
Static task
static1
Behavioral task
behavioral1
Sample
08ff0b6888fcd252d4fec46edd2508bf.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
08ff0b6888fcd252d4fec46edd2508bf.exe
Resource
win10v2004-20231215-en
General
-
Target
08ff0b6888fcd252d4fec46edd2508bf.exe
-
Size
84KB
-
MD5
08ff0b6888fcd252d4fec46edd2508bf
-
SHA1
d1b045307b77294762e340103636d7974c082e2b
-
SHA256
04c57831d8fa1fbf079f2e59d96d31a104d9abd2bd37128144f55ca6f74eb478
-
SHA512
510500ead5940f611e53cfbf83e8ce64363bef4e490cab23915564f12caa5d5560419a14eed19ac04548337b71ea1058881999fb0e012711ac84c4b3a9c57c5f
-
SSDEEP
1536:S7lBit0QRysgef9/+O04JhDIczCDxuin4V:S5ofkt+9mO04oczcxyV
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 1468 08ff0b6888fcd252d4fec46edd2508bf.exe -
Executes dropped EXE 1 IoCs
pid Process 1468 08ff0b6888fcd252d4fec46edd2508bf.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 2180 08ff0b6888fcd252d4fec46edd2508bf.exe -
Suspicious use of UnmapMainImage 2 IoCs
pid Process 2180 08ff0b6888fcd252d4fec46edd2508bf.exe 1468 08ff0b6888fcd252d4fec46edd2508bf.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2180 wrote to memory of 1468 2180 08ff0b6888fcd252d4fec46edd2508bf.exe 92 PID 2180 wrote to memory of 1468 2180 08ff0b6888fcd252d4fec46edd2508bf.exe 92 PID 2180 wrote to memory of 1468 2180 08ff0b6888fcd252d4fec46edd2508bf.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\08ff0b6888fcd252d4fec46edd2508bf.exe"C:\Users\Admin\AppData\Local\Temp\08ff0b6888fcd252d4fec46edd2508bf.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2180 -
C:\Users\Admin\AppData\Local\Temp\08ff0b6888fcd252d4fec46edd2508bf.exeC:\Users\Admin\AppData\Local\Temp\08ff0b6888fcd252d4fec46edd2508bf.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
PID:1468
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
84KB
MD5337ade8e9f4e11491383506228a9eee4
SHA1eb1bd1204d834adb4e8e5c3f496d119b3e440528
SHA25611dec441733f276a96a17e5768f7aa6b06ae18362618f2da1f8ee2f328351e05
SHA51206a710baeb84f4236064e543498cb57c497a354cb00e229d201acba0104728b6964f7d8f4079c2efd2c158431b6ac043715c05b9a402f472cc98c6c165c1c751