Analysis

  • max time kernel
    148s
  • max time network
    130s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26/12/2023, 12:40

General

  • Target

    6f3d4851923cbd6fd28519156bc96bd7.exe

  • Size

    258KB

  • MD5

    6f3d4851923cbd6fd28519156bc96bd7

  • SHA1

    afa9a559170479292a158186653d807e4e043979

  • SHA256

    15387a0106b9da8d12153eabf827bb6c306387059445bb4df4516b36dd7bd6f2

  • SHA512

    11c26cfd989b71b6bd1b69607c350ede3ccbb26b137aa2e65522010b1f4a4cf458e1c0add5fcafe25ebdfa97b7faece6b8d962a5f02a60039aa25809ed187f71

  • SSDEEP

    3072:EvcP6pi6fZbv4c9nhaWEtZA9msMG4qBMBlOreNh4s7GsPQtTpaqXIVItTXRHc7:EvcPkfVz02m5qOl2e0s6aqXSItTBHO

Score
6/10

Malware Config

Signatures

  • Maps connected drives based on registry 3 TTPs 2 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in Windows directory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6f3d4851923cbd6fd28519156bc96bd7.exe
    "C:\Users\Admin\AppData\Local\Temp\6f3d4851923cbd6fd28519156bc96bd7.exe"
    1⤵
    • Maps connected drives based on registry
    • Drops file in Windows directory
    PID:5044

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/5044-1-0x0000000000590000-0x0000000000591000-memory.dmp

    Filesize

    4KB

  • memory/5044-3-0x00000000005A0000-0x00000000005A1000-memory.dmp

    Filesize

    4KB

  • memory/5044-9-0x00000000005C0000-0x00000000005E9000-memory.dmp

    Filesize

    164KB

  • memory/5044-16-0x00000000005C0000-0x00000000005E9000-memory.dmp

    Filesize

    164KB

  • memory/5044-18-0x00000000005C0000-0x00000000005E9000-memory.dmp

    Filesize

    164KB

  • memory/5044-12-0x0000000004F00000-0x0000000004F27000-memory.dmp

    Filesize

    156KB

  • memory/5044-25-0x00000000005C0000-0x00000000005E9000-memory.dmp

    Filesize

    164KB

  • memory/5044-5-0x0000000000CE0000-0x0000000000D0F000-memory.dmp

    Filesize

    188KB

  • memory/5044-4-0x00000000005C0000-0x00000000005E9000-memory.dmp

    Filesize

    164KB

  • memory/5044-2-0x00000000005B0000-0x00000000005B1000-memory.dmp

    Filesize

    4KB

  • memory/5044-0-0x0000000000580000-0x0000000000581000-memory.dmp

    Filesize

    4KB