Analysis
-
max time kernel
148s -
max time network
65s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
30-12-2023 22:12
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1e15dff6f4219f6fe1e9e037e3423310.exe
Resource
win7-20231215-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
1e15dff6f4219f6fe1e9e037e3423310.exe
Resource
win10v2004-20231222-en
windows10-2004-x64
5 signatures
150 seconds
General
-
Target
1e15dff6f4219f6fe1e9e037e3423310.exe
-
Size
82KB
-
MD5
1e15dff6f4219f6fe1e9e037e3423310
-
SHA1
969cf4f3a0ceb8b593bbb5b66d382797e8ab4802
-
SHA256
d3c67935a09c9e889f2f4b4dda4aa0fc55bfd20595446ad6d927e3b06cde1e84
-
SHA512
af92fa5458044efccc5ab0e139ef00c6fddcee161538d2a9d1e65592c45a9f281e8e48dc1fb866be3b4396bf74967c9101342eca1a8b0aecc11fc7d2fc116d99
-
SSDEEP
1536:6pT3IXW+o+7B44eE/Hv/+alWI9892D5XjKxZhEFqWrfCh316y9+UvB0pfC:k3n+hOJEmD+5XGmmhfKpfC
Score
7/10
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 680 1e15dff6f4219f6fe1e9e037e3423310.exe -
Executes dropped EXE 1 IoCs
pid Process 680 1e15dff6f4219f6fe1e9e037e3423310.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 208 1e15dff6f4219f6fe1e9e037e3423310.exe -
Suspicious use of UnmapMainImage 2 IoCs
pid Process 208 1e15dff6f4219f6fe1e9e037e3423310.exe 680 1e15dff6f4219f6fe1e9e037e3423310.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 208 wrote to memory of 680 208 1e15dff6f4219f6fe1e9e037e3423310.exe 16 PID 208 wrote to memory of 680 208 1e15dff6f4219f6fe1e9e037e3423310.exe 16 PID 208 wrote to memory of 680 208 1e15dff6f4219f6fe1e9e037e3423310.exe 16
Processes
-
C:\Users\Admin\AppData\Local\Temp\1e15dff6f4219f6fe1e9e037e3423310.exe"C:\Users\Admin\AppData\Local\Temp\1e15dff6f4219f6fe1e9e037e3423310.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:208 -
C:\Users\Admin\AppData\Local\Temp\1e15dff6f4219f6fe1e9e037e3423310.exeC:\Users\Admin\AppData\Local\Temp\1e15dff6f4219f6fe1e9e037e3423310.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
PID:680
-