Analysis
-
max time kernel
149s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
30/12/2023, 21:53
Static task
static1
Behavioral task
behavioral1
Sample
1dab7dcd60646c0023b9af879bd54752.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
1dab7dcd60646c0023b9af879bd54752.exe
Resource
win10v2004-20231215-en
General
-
Target
1dab7dcd60646c0023b9af879bd54752.exe
-
Size
82KB
-
MD5
1dab7dcd60646c0023b9af879bd54752
-
SHA1
040813c1cb7a675e4298ab4733e97800a6a63375
-
SHA256
62088a2966555a2e552cf4fb6644966e58d4454354467adc257e4e985786df93
-
SHA512
64062382881a2db5f8695ddacd259a7b32a8d87e38635709b332dd3f543f3720b080f0bb8777ef91a6f51650933a78d3769ff83e7d1d2e22af1e5ab9241d6eff
-
SSDEEP
1536:II2XS2u7JD+m7v7KTO6DcJZduau6tzh540zZg5vRBCETetlpJ:jzp+KgOjj540lgtS24pJ
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 4724 1dab7dcd60646c0023b9af879bd54752.exe -
Executes dropped EXE 1 IoCs
pid Process 4724 1dab7dcd60646c0023b9af879bd54752.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 4456 1dab7dcd60646c0023b9af879bd54752.exe -
Suspicious use of UnmapMainImage 2 IoCs
pid Process 4456 1dab7dcd60646c0023b9af879bd54752.exe 4724 1dab7dcd60646c0023b9af879bd54752.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4456 wrote to memory of 4724 4456 1dab7dcd60646c0023b9af879bd54752.exe 89 PID 4456 wrote to memory of 4724 4456 1dab7dcd60646c0023b9af879bd54752.exe 89 PID 4456 wrote to memory of 4724 4456 1dab7dcd60646c0023b9af879bd54752.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\1dab7dcd60646c0023b9af879bd54752.exe"C:\Users\Admin\AppData\Local\Temp\1dab7dcd60646c0023b9af879bd54752.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:4456 -
C:\Users\Admin\AppData\Local\Temp\1dab7dcd60646c0023b9af879bd54752.exeC:\Users\Admin\AppData\Local\Temp\1dab7dcd60646c0023b9af879bd54752.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
PID:4724
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
82KB
MD5a1018b08282dbec57301bb700f7aa932
SHA15e0cae40640e7230518e95260c30bf6aacf5e02e
SHA256501e4c49987eda2e612d38b31f56f19a6a006841021eceeb3ab63ff4a66c8144
SHA5126ecd451f7a0f2dc84ca8bd448ed5e7ff1991644c2b7b40a168aa8fd7b4b9fd904caa826c64db6ac965eb7993c68d7bebff224817a8d1d2da1092e8b360c09d17