Analysis

  • max time kernel
    122s
  • max time network
    225s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    30/12/2023, 02:10

General

  • Target

    0b316ec98c9320a130414c944ce757b6.exe

  • Size

    907KB

  • MD5

    0b316ec98c9320a130414c944ce757b6

  • SHA1

    e020244caa929100ab776246597cd8516aed588a

  • SHA256

    86df16f3d06cebd640d3ea90d2829353d3fd917c387c51074f00f28601a256a0

  • SHA512

    e784a06520160f05c7ca1788fc694396896c6a37e98e850efbc5d3721964fa42606989eba364702131c60952093220ab24e35142b0e2abf2e54cc311905b1c45

  • SSDEEP

    24576:zuMwJFlSyCG7jEdeaY/KpiIBkiZyVeR1Aa/ZS1:WJbh6m/LIBhKeR1AgS

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0b316ec98c9320a130414c944ce757b6.exe
    "C:\Users\Admin\AppData\Local\Temp\0b316ec98c9320a130414c944ce757b6.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: RenamesItself
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:2596
    • C:\Users\Admin\AppData\Local\Temp\0b316ec98c9320a130414c944ce757b6.exe
      C:\Users\Admin\AppData\Local\Temp\0b316ec98c9320a130414c944ce757b6.exe
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Suspicious use of UnmapMainImage
      PID:2740

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\0b316ec98c9320a130414c944ce757b6.exe

    Filesize

    190KB

    MD5

    a4e09fe3fddb8ea8688b370fd700ed06

    SHA1

    d019fa508bbfd637e4b8e2f2deeb7ff2bd3bcef6

    SHA256

    1cf21730d0f7c596383e4814fbac976d8b1a7012a47034146f438afbdf3c8ba3

    SHA512

    d68be611cc28865460f37207204999046b8f45f821202d4c25e6517d70d9fe868c05f203dc1e3f803b3583cad4d5a3261ab4bc0890b870bb17fc3d6db364939e

  • C:\Users\Admin\AppData\Local\Temp\Cab98F7.tmp

    Filesize

    65KB

    MD5

    ac05d27423a85adc1622c714f2cb6184

    SHA1

    b0fe2b1abddb97837ea0195be70ab2ff14d43198

    SHA256

    c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

    SHA512

    6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

  • C:\Users\Admin\AppData\Local\Temp\Tar9938.tmp

    Filesize

    76KB

    MD5

    7395e1124cc09d781809891ff0cb4928

    SHA1

    de73611869605ff8f4dfeae887529e3a22d3f640

    SHA256

    f8217d6e38203ce393b17828bb7d0446c4ca10960ca6f8e3be9f11cf1278b918

    SHA512

    07acd933d92f79a651636a06b77bccee2d13983bffe480bf8fb171d4da74f5b9866e6c0a00d900df154a2552251e67b28b400032edb25ee7ca664455c5a46576

  • \Users\Admin\AppData\Local\Temp\0b316ec98c9320a130414c944ce757b6.exe

    Filesize

    907KB

    MD5

    f263932a6220ff7be5ef416698ed0c1b

    SHA1

    0cf9a6e8fb3b32286680783f3388ea14735a59ce

    SHA256

    5a938468e228834439fb5f4d8763715c26989e9f335ba04b277b2c0275f661fd

    SHA512

    f517b8c384dc89bc94653bc2d631ef9a892a4338556e84ae2ba49427094135ba194e0f0849741e88e176ade3b60ef2286d267b0ddb0fd69cdb7847d05f0592d9

  • memory/2596-13-0x0000000000400000-0x00000000004BB000-memory.dmp

    Filesize

    748KB

  • memory/2596-0-0x0000000000400000-0x00000000004E8000-memory.dmp

    Filesize

    928KB

  • memory/2596-2-0x0000000000300000-0x00000000003E8000-memory.dmp

    Filesize

    928KB

  • memory/2596-1-0x0000000000400000-0x00000000004BB000-memory.dmp

    Filesize

    748KB

  • memory/2740-15-0x0000000000400000-0x00000000004E8000-memory.dmp

    Filesize

    928KB

  • memory/2740-17-0x00000000014F0000-0x00000000015D8000-memory.dmp

    Filesize

    928KB

  • memory/2740-23-0x0000000002F40000-0x0000000002FFB000-memory.dmp

    Filesize

    748KB

  • memory/2740-22-0x0000000000400000-0x0000000000498000-memory.dmp

    Filesize

    608KB

  • memory/2740-76-0x0000000000400000-0x0000000000443000-memory.dmp

    Filesize

    268KB

  • memory/2740-78-0x000000000DB00000-0x000000000DB98000-memory.dmp

    Filesize

    608KB