Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
-
submitted
30-12-2023 04:51
General
-
Target
0f1a5315e2beffdab19897c3f02434e8.exe
-
Size
82KB
-
MD5
0f1a5315e2beffdab19897c3f02434e8
-
SHA1
d64aca90b59a97aa102ef8620e6e032512199150
-
SHA256
3ca2b874ece51139a1a75e553ec1e860a503cca1491466e14b58086aed316b0c
-
SHA512
1ebbf75259cc1c3222dd4fe2cf7a85ab6484fe54d404674c99ff42be61d5ad18737fbe8fec8a036091021595d87c5a681b84158830264d80b5a2346468046b31
-
SSDEEP
1536:0rxFSj+GceBS5SYW2apswa0bzTagIBrfcvLrqTd3S0xvWTQW9yED+ai9kJduPy49:0fSj+GceBS5pJapswa0XTalBrfcTrwvj
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0f1a5315e2beffdab19897c3f02434e8.exe"C:\Users\Admin\AppData\Local\Temp\0f1a5315e2beffdab19897c3f02434e8.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\0f1a5315e2beffdab19897c3f02434e8.exeC:\Users\Admin\AppData\Local\Temp\0f1a5315e2beffdab19897c3f02434e8.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
82KB
MD5db4397031f7101e29c6d032e4143862f
SHA1581c7ea1f25d0f06f9a9ac7073ebbd9e4e43ad91
SHA256241e11fce10a5568b4abaea2ad605adfe1f59c9e22d5644c9ad14b7ae3be6fba
SHA512947f1fa2924b716abc2764b405a62680884a9cabf3e1ba7c3e03b9a98d13e9daf827e5467910d14a00cd91cd77607f4dc41e70edf3206fdd4b3345de66d09db3
-
Filesize
188KB
-
Filesize
188KB
-
Filesize
56KB
-
Filesize
108KB
-
Filesize
188KB
-
Filesize
108KB
-
Filesize
188KB
-
Filesize
108KB
-
Filesize
188KB