Analysis
-
max time kernel
137s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
29-12-2023 23:48
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
077d313ccd70e20869b1f9cdb5f95769.exe
Resource
win7-20231215-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
077d313ccd70e20869b1f9cdb5f95769.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
5 signatures
150 seconds
General
-
Target
077d313ccd70e20869b1f9cdb5f95769.exe
-
Size
1.6MB
-
MD5
077d313ccd70e20869b1f9cdb5f95769
-
SHA1
2a69b1782591de6c7bd06931d766fc2344d4316c
-
SHA256
c39ce5ab91d3446d359a478a12cb2051d1b4785d7320a4b8a37d5617cbcc449a
-
SHA512
9f5fabd6d16535610e07c54808b51ccf69931c9d52416f79872a012489e10d29ad7d1453004a439028e1bc9d457ab028be406ab374ae303f2c886cc721331016
-
SSDEEP
49152:apqD5w757eJb7kx1yME7eyoBN08ns26tMc:apM+wnkXA7BoBqX2O
Score
7/10
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 3048 077d313ccd70e20869b1f9cdb5f95769.exe -
Executes dropped EXE 1 IoCs
pid Process 3048 077d313ccd70e20869b1f9cdb5f95769.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 4080 077d313ccd70e20869b1f9cdb5f95769.exe -
Suspicious use of UnmapMainImage 2 IoCs
pid Process 4080 077d313ccd70e20869b1f9cdb5f95769.exe 3048 077d313ccd70e20869b1f9cdb5f95769.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4080 wrote to memory of 3048 4080 077d313ccd70e20869b1f9cdb5f95769.exe 19 PID 4080 wrote to memory of 3048 4080 077d313ccd70e20869b1f9cdb5f95769.exe 19 PID 4080 wrote to memory of 3048 4080 077d313ccd70e20869b1f9cdb5f95769.exe 19
Processes
-
C:\Users\Admin\AppData\Local\Temp\077d313ccd70e20869b1f9cdb5f95769.exe"C:\Users\Admin\AppData\Local\Temp\077d313ccd70e20869b1f9cdb5f95769.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:4080 -
C:\Users\Admin\AppData\Local\Temp\077d313ccd70e20869b1f9cdb5f95769.exeC:\Users\Admin\AppData\Local\Temp\077d313ccd70e20869b1f9cdb5f95769.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
PID:3048
-