Analysis
-
max time kernel
166s -
max time network
171s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
29/12/2023, 22:42
Static task
static1
Behavioral task
behavioral1
Sample
05f32bffbdf021bf8cf2c36f85fa5494.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
05f32bffbdf021bf8cf2c36f85fa5494.exe
Resource
win10v2004-20231215-en
General
-
Target
05f32bffbdf021bf8cf2c36f85fa5494.exe
-
Size
1.9MB
-
MD5
05f32bffbdf021bf8cf2c36f85fa5494
-
SHA1
944bfc5159b0bdb2a0914e549d9a29cab1d76f14
-
SHA256
85fa1cd0645678ad7d5481a1ac09d6665c695aad27bda1d9e22d231f86eb516a
-
SHA512
9d166ac0264902d6e3d6b39e25428c59ae59b1c04788636a4b4cba98a65ac2c3e3b2785347cd806e5ea005809c8e65ce20927d87beb8f24a38f8653485a9a8b4
-
SSDEEP
49152:Qoa1taC070dJm5EIBWx0FKL4gr6VNWDfxvHCr9KbI:Qoa1taC00mzYyq4NVNWDZfI
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 1708 ECC1.tmp -
Executes dropped EXE 1 IoCs
pid Process 1708 ECC1.tmp -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2332 wrote to memory of 1708 2332 05f32bffbdf021bf8cf2c36f85fa5494.exe 90 PID 2332 wrote to memory of 1708 2332 05f32bffbdf021bf8cf2c36f85fa5494.exe 90 PID 2332 wrote to memory of 1708 2332 05f32bffbdf021bf8cf2c36f85fa5494.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\05f32bffbdf021bf8cf2c36f85fa5494.exe"C:\Users\Admin\AppData\Local\Temp\05f32bffbdf021bf8cf2c36f85fa5494.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2332 -
C:\Users\Admin\AppData\Local\Temp\ECC1.tmp"C:\Users\Admin\AppData\Local\Temp\ECC1.tmp" --splashC:\Users\Admin\AppData\Local\Temp\05f32bffbdf021bf8cf2c36f85fa5494.exe 73635F07C44FE40D8E552D3E82B2C011BE936E60A4129C4F1DB101B92C085EC83B7BBAD49CEA2D3CA540312641AEA4DB18454D8880EA62ECB4AA749E1D5FAD7B2⤵
- Deletes itself
- Executes dropped EXE
PID:1708
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
209KB
MD5849ed59336dcc9ca5178eb5244933922
SHA10685c45cdcfd48654a2b9e67e4ea6cbb2b3c3ed3
SHA2568910358d66a3c1e0c4a867b31b9b016de0fc150544822d2696306bcb06b04178
SHA5121bab76c7a9d48a5a18f88686a3570a78bffdfb42cf7edf1cf469b2966264272fab0e180fccf86f18b8aceff2da3bc082e7ef9f593ffbf5c388d8d4f837bc13c1
-
Filesize
271KB
MD52803497f85b8828a9549e3b2f9e82557
SHA1136d87a724f0440b78b50fda6bd7b4c93f5c9509
SHA256293ba1101a84eb0b8b1380bb9993a51fef661dc6a5644a0220d6799969c59d3a
SHA512feb349996cddeebef9cc99f516193b977980e435b6d418633b303083a519fe58e8a363382986e233007a866ef43d1410f1a5f6be98fb7989d4cab5d3c8f1148b