Analysis
-
max time kernel
0s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
30/12/2023, 01:56
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0ad64de0cd451463d8ed4cda4d12ab35.exe
Resource
win7-20231129-en
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
0ad64de0cd451463d8ed4cda4d12ab35.exe
Resource
win10v2004-20231215-en
6 signatures
150 seconds
General
-
Target
0ad64de0cd451463d8ed4cda4d12ab35.exe
-
Size
385KB
-
MD5
0ad64de0cd451463d8ed4cda4d12ab35
-
SHA1
ae48b65a8527c565352ae54c2afd1085f9d1a0fa
-
SHA256
c7f85838911bcde578c1b06e0363c8048b6c683430ed655ab579a791b847f3b8
-
SHA512
721a1afbbecb85c29c471b9812d5f9d78e238c274a7bece1fb26c26735904a159f7b4c27dd6df95823b5c2201af419e615f16f68b1710c44e2009337800ec54d
-
SSDEEP
12288:mC9Wk05rgr2o9wzKohxO5B/T10z/AVZz3e54gcgP8XYBlKBBd1O///BDtwYU498P:mC9Wk05lSEhy/j3DfUgb1B
Score
7/10
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2340 0ad64de0cd451463d8ed4cda4d12ab35.exe -
Executes dropped EXE 1 IoCs
pid Process 2340 0ad64de0cd451463d8ed4cda4d12ab35.exe -
Loads dropped DLL 1 IoCs
pid Process 1700 0ad64de0cd451463d8ed4cda4d12ab35.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Suspicious behavior: RenamesItself 1 IoCs
pid Process 1700 0ad64de0cd451463d8ed4cda4d12ab35.exe -
Suspicious use of UnmapMainImage 2 IoCs
pid Process 1700 0ad64de0cd451463d8ed4cda4d12ab35.exe 2340 0ad64de0cd451463d8ed4cda4d12ab35.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1700 wrote to memory of 2340 1700 0ad64de0cd451463d8ed4cda4d12ab35.exe 16 PID 1700 wrote to memory of 2340 1700 0ad64de0cd451463d8ed4cda4d12ab35.exe 16 PID 1700 wrote to memory of 2340 1700 0ad64de0cd451463d8ed4cda4d12ab35.exe 16 PID 1700 wrote to memory of 2340 1700 0ad64de0cd451463d8ed4cda4d12ab35.exe 16
Processes
-
C:\Users\Admin\AppData\Local\Temp\0ad64de0cd451463d8ed4cda4d12ab35.exe"C:\Users\Admin\AppData\Local\Temp\0ad64de0cd451463d8ed4cda4d12ab35.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1700 -
C:\Users\Admin\AppData\Local\Temp\0ad64de0cd451463d8ed4cda4d12ab35.exeC:\Users\Admin\AppData\Local\Temp\0ad64de0cd451463d8ed4cda4d12ab35.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
PID:2340
-