Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
30/12/2023, 21:32
Static task
static1
Behavioral task
behavioral1
Sample
1d1a6778eb52658757ea5c1a6be70ac3.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
1d1a6778eb52658757ea5c1a6be70ac3.exe
Resource
win10v2004-20231222-en
General
-
Target
1d1a6778eb52658757ea5c1a6be70ac3.exe
-
Size
82KB
-
MD5
1d1a6778eb52658757ea5c1a6be70ac3
-
SHA1
015fd0d6fc02bccc47aae67c32d93efe9aedd9a6
-
SHA256
68c622a65f1d5265129b491c252b885bcf9764615d1db0f9ab04f7e6ccaa24dd
-
SHA512
887cecfcbe13df3785b54c241bab17db62ea692b900efdcd890a8060d9e452a9f772e570e42f1235efef054a04b00a98f492f0e11f8f201d7b9381ffdc5042c0
-
SSDEEP
1536:SskoZ6dqUPZlz5oqTmlBNaqZs9OJVVrGYgHTHtT:SHoQvZld/GVBy5HB
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 3032 1d1a6778eb52658757ea5c1a6be70ac3.exe -
Executes dropped EXE 1 IoCs
pid Process 3032 1d1a6778eb52658757ea5c1a6be70ac3.exe -
Loads dropped DLL 1 IoCs
pid Process 2904 1d1a6778eb52658757ea5c1a6be70ac3.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 2904 1d1a6778eb52658757ea5c1a6be70ac3.exe -
Suspicious use of UnmapMainImage 2 IoCs
pid Process 2904 1d1a6778eb52658757ea5c1a6be70ac3.exe 3032 1d1a6778eb52658757ea5c1a6be70ac3.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2904 wrote to memory of 3032 2904 1d1a6778eb52658757ea5c1a6be70ac3.exe 29 PID 2904 wrote to memory of 3032 2904 1d1a6778eb52658757ea5c1a6be70ac3.exe 29 PID 2904 wrote to memory of 3032 2904 1d1a6778eb52658757ea5c1a6be70ac3.exe 29 PID 2904 wrote to memory of 3032 2904 1d1a6778eb52658757ea5c1a6be70ac3.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\1d1a6778eb52658757ea5c1a6be70ac3.exe"C:\Users\Admin\AppData\Local\Temp\1d1a6778eb52658757ea5c1a6be70ac3.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2904 -
C:\Users\Admin\AppData\Local\Temp\1d1a6778eb52658757ea5c1a6be70ac3.exeC:\Users\Admin\AppData\Local\Temp\1d1a6778eb52658757ea5c1a6be70ac3.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
PID:3032
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
19KB
MD521d9d99bc3f54076f9c210bded44f314
SHA1c32018e7147332965b13bd1016f049701d74e842
SHA25658889f984f9517761381efbfabf469ad90067d796918496792a4775f4bb3bffe
SHA512f08bfcbe0d30f71f52add01271d7a564ad4ec0ff252149e0c9dbb8afd8fcf26dc99e3bf75d958661e9554cc6e20414f58f007f17828db68885a98821d05b7465
-
Filesize
82KB
MD5b0f8047879313ce179904fd5e0f2f9c4
SHA1721822b1595b81e50545bf2e62952e1840279603
SHA2564e7b3666c946a3dbbde4f6227d5cbc970f2cebae66ae3ab46ec93aa32ca8020f
SHA5121e308f28a7dc66c258319c74f9ee4c2bd5afceb2fa29512557f3fda4b93fb321f14bde1419b51205b9c5ba3bcfcefabeb276f77482b16ed653103402a5dc92f6