Analysis
-
max time kernel
160s -
max time network
179s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
25-12-2023 16:20
General
-
Target
2ca479cdbaa89bc3bc65f23b6fa7ce68.exe
-
Size
2.1MB
-
MD5
2ca479cdbaa89bc3bc65f23b6fa7ce68
-
SHA1
c1d50fbc1f951c50011a934da130c5250ead8e27
-
SHA256
52c3223b70459ec6606d6b3a03dbab4b86421c381a7ba8ffed7b5c5b31374394
-
SHA512
9de01235bc24ac6d23184e0899bab77975a6775273ca0427aa1f7651b14bf44cad9452c90a44d366f622f5b5cfa32696ba106673cbb90b2dd2d3e95e798b6493
-
SSDEEP
49152:TaO6seoygHEmNw9ur56+8dwA/OYtiW4jClzXp3ZYoc9O:+VoREmsS6lyY0XCpZ3ZFD
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 3 IoCs
-
Script User-Agent 4 IoCs
Uses user-agent string associated with script host/environment.
-
Suspicious behavior: EnumeratesProcesses 40 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2ca479cdbaa89bc3bc65f23b6fa7ce68.exe"C:\Users\Admin\AppData\Local\Temp\2ca479cdbaa89bc3bc65f23b6fa7ce68.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-94HV1.tmp\2ca479cdbaa89bc3bc65f23b6fa7ce68.tmp"C:\Users\Admin\AppData\Local\Temp\is-94HV1.tmp\2ca479cdbaa89bc3bc65f23b6fa7ce68.tmp" /SL5="$9018E,1908789,54272,C:\Users\Admin\AppData\Local\Temp\2ca479cdbaa89bc3bc65f23b6fa7ce68.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
688KB
MD567c5a4f36e1c91a3b85e440edd7ad026
SHA1e49ea0e558ed682498cc61b3070e4c402fbf0912
SHA25699c299d6565ab53d9af66e0146737dc0ecfbc52ecf4740825b552db0cc4210c6
SHA51240522d4645ece0db9888ea40d1a11356aa5efc191184a0b97cb54a6c243532b1fc306e9095bbfa1f5dc02c8e52b709650230d1383532136e56caea3dc19a973e
-
Filesize
361KB
MD58fa84b1ffa671d38ecfadccc87967597
SHA16c78f65d08bcc996e8303c8ba8a063666569dd18
SHA256820a2373f4e57083a9b449275a3c9f953b781ac38fd03ce56ccecf6dfa87462a
SHA51267055cd178ea451941839139725166e5b520996a076aee9b2cadf361606f9a16a65a2faa9b5393edd4d3e02ab2a2c0ffa8db673b666984ee0585bf95032c7475
-
Filesize
200KB
MD5d82a429efd885ca0f324dd92afb6b7b8
SHA186bbdaa15e6fc5c7779ac69c84e53c43c9eb20ea
SHA256b258c4d7d2113dee2168ed7e35568c8e03341e24e3eafc7a22a0d62e32122ef3
SHA5125bf0c3b8fa5db63205a263c4fa5337188173248bef609ba4d03508c50db1fd1e336f3041ce96d78cc97659357a83e6e422f5b079d893a20a683270e05f5438df
-
Filesize
36KB
MD5a4e5c512b047a6d9dc38549161cac4de
SHA149d3e74f9604a6c61cda04ccc6d3cda87e280dfb
SHA256c7f1e7e866834d9024f97c2b145c09d106e447e8abd65a10a1732116d178e44e
SHA5122edb8a492b8369d56dda735a652c9e08539a5c4709a794efaff91adcae192a636d0545725af16cf8c31b275b34c2f19e4b019b57fb9050b99de65a4c08e3eee1
-
Filesize
80KB
-
Filesize
80KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
240KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
752KB
-
Filesize
240KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
240KB