Analysis
-
max time kernel
138s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
30-12-2023 09:34
Static task
static1
Behavioral task
behavioral1
Sample
14a11a8a85f7d2d41de19ea56e6bc64a.exe
Resource
win7-20231215-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
14a11a8a85f7d2d41de19ea56e6bc64a.exe
Resource
win10v2004-20231222-en
windows10-2004-x64
5 signatures
150 seconds
General
-
Target
14a11a8a85f7d2d41de19ea56e6bc64a.exe
-
Size
86KB
-
MD5
14a11a8a85f7d2d41de19ea56e6bc64a
-
SHA1
8acb750730ead9557005fa667581155c5b6bd533
-
SHA256
44649fe1bb4d6f546909b1514fc53d02e19a5ed43f1a7bdb2f61072b9f8215a7
-
SHA512
24759a4179af3eb6af78a1b54e1491ff71895af5025765a30f91533f3a9cb6698d8ab1dc33b3777b7b3f2ddd550c3f8954491a3027d14cff1deb39eecf847ad5
-
SSDEEP
768:/2TTcTlj6JCcBEJU1HOvwBfzxQiL6DTl1IWJdM:/2TIN6JCcBTHPiiL6DkmdM
Score
7/10
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2576 cmd.exe -
Executes dropped EXE 1 IoCs
pid Process 1980 2345safe.exe -
Loads dropped DLL 2 IoCs
pid Process 1992 14a11a8a85f7d2d41de19ea56e6bc64a.exe 1992 14a11a8a85f7d2d41de19ea56e6bc64a.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files\360safe\2345safe.exe 14a11a8a85f7d2d41de19ea56e6bc64a.exe File opened for modification C:\Program Files\360safe\2345safe.exe 14a11a8a85f7d2d41de19ea56e6bc64a.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1992 14a11a8a85f7d2d41de19ea56e6bc64a.exe 1992 14a11a8a85f7d2d41de19ea56e6bc64a.exe 1992 14a11a8a85f7d2d41de19ea56e6bc64a.exe 1992 14a11a8a85f7d2d41de19ea56e6bc64a.exe 1992 14a11a8a85f7d2d41de19ea56e6bc64a.exe 1992 14a11a8a85f7d2d41de19ea56e6bc64a.exe 1992 14a11a8a85f7d2d41de19ea56e6bc64a.exe 1992 14a11a8a85f7d2d41de19ea56e6bc64a.exe 1992 14a11a8a85f7d2d41de19ea56e6bc64a.exe 1992 14a11a8a85f7d2d41de19ea56e6bc64a.exe 1992 14a11a8a85f7d2d41de19ea56e6bc64a.exe 1992 14a11a8a85f7d2d41de19ea56e6bc64a.exe 1992 14a11a8a85f7d2d41de19ea56e6bc64a.exe 1992 14a11a8a85f7d2d41de19ea56e6bc64a.exe 1992 14a11a8a85f7d2d41de19ea56e6bc64a.exe 1992 14a11a8a85f7d2d41de19ea56e6bc64a.exe 1992 14a11a8a85f7d2d41de19ea56e6bc64a.exe 1992 14a11a8a85f7d2d41de19ea56e6bc64a.exe 1992 14a11a8a85f7d2d41de19ea56e6bc64a.exe 1992 14a11a8a85f7d2d41de19ea56e6bc64a.exe 1992 14a11a8a85f7d2d41de19ea56e6bc64a.exe 1992 14a11a8a85f7d2d41de19ea56e6bc64a.exe 1992 14a11a8a85f7d2d41de19ea56e6bc64a.exe 1992 14a11a8a85f7d2d41de19ea56e6bc64a.exe 1992 14a11a8a85f7d2d41de19ea56e6bc64a.exe 1992 14a11a8a85f7d2d41de19ea56e6bc64a.exe 1992 14a11a8a85f7d2d41de19ea56e6bc64a.exe 1992 14a11a8a85f7d2d41de19ea56e6bc64a.exe 1992 14a11a8a85f7d2d41de19ea56e6bc64a.exe 1992 14a11a8a85f7d2d41de19ea56e6bc64a.exe 1992 14a11a8a85f7d2d41de19ea56e6bc64a.exe 1992 14a11a8a85f7d2d41de19ea56e6bc64a.exe 1992 14a11a8a85f7d2d41de19ea56e6bc64a.exe 1992 14a11a8a85f7d2d41de19ea56e6bc64a.exe 1992 14a11a8a85f7d2d41de19ea56e6bc64a.exe 1992 14a11a8a85f7d2d41de19ea56e6bc64a.exe 1992 14a11a8a85f7d2d41de19ea56e6bc64a.exe 1992 14a11a8a85f7d2d41de19ea56e6bc64a.exe 1992 14a11a8a85f7d2d41de19ea56e6bc64a.exe 1992 14a11a8a85f7d2d41de19ea56e6bc64a.exe 1992 14a11a8a85f7d2d41de19ea56e6bc64a.exe 1992 14a11a8a85f7d2d41de19ea56e6bc64a.exe 1992 14a11a8a85f7d2d41de19ea56e6bc64a.exe 1992 14a11a8a85f7d2d41de19ea56e6bc64a.exe 1992 14a11a8a85f7d2d41de19ea56e6bc64a.exe 1992 14a11a8a85f7d2d41de19ea56e6bc64a.exe 1992 14a11a8a85f7d2d41de19ea56e6bc64a.exe 1992 14a11a8a85f7d2d41de19ea56e6bc64a.exe 1992 14a11a8a85f7d2d41de19ea56e6bc64a.exe 1992 14a11a8a85f7d2d41de19ea56e6bc64a.exe 1992 14a11a8a85f7d2d41de19ea56e6bc64a.exe 1992 14a11a8a85f7d2d41de19ea56e6bc64a.exe 1992 14a11a8a85f7d2d41de19ea56e6bc64a.exe 1992 14a11a8a85f7d2d41de19ea56e6bc64a.exe 1992 14a11a8a85f7d2d41de19ea56e6bc64a.exe 1992 14a11a8a85f7d2d41de19ea56e6bc64a.exe 1992 14a11a8a85f7d2d41de19ea56e6bc64a.exe 1992 14a11a8a85f7d2d41de19ea56e6bc64a.exe 1992 14a11a8a85f7d2d41de19ea56e6bc64a.exe 1992 14a11a8a85f7d2d41de19ea56e6bc64a.exe 1992 14a11a8a85f7d2d41de19ea56e6bc64a.exe 1992 14a11a8a85f7d2d41de19ea56e6bc64a.exe 1992 14a11a8a85f7d2d41de19ea56e6bc64a.exe 1992 14a11a8a85f7d2d41de19ea56e6bc64a.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1992 14a11a8a85f7d2d41de19ea56e6bc64a.exe 1980 2345safe.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1992 wrote to memory of 1980 1992 14a11a8a85f7d2d41de19ea56e6bc64a.exe 30 PID 1992 wrote to memory of 1980 1992 14a11a8a85f7d2d41de19ea56e6bc64a.exe 30 PID 1992 wrote to memory of 1980 1992 14a11a8a85f7d2d41de19ea56e6bc64a.exe 30 PID 1992 wrote to memory of 1980 1992 14a11a8a85f7d2d41de19ea56e6bc64a.exe 30 PID 1992 wrote to memory of 2576 1992 14a11a8a85f7d2d41de19ea56e6bc64a.exe 31 PID 1992 wrote to memory of 2576 1992 14a11a8a85f7d2d41de19ea56e6bc64a.exe 31 PID 1992 wrote to memory of 2576 1992 14a11a8a85f7d2d41de19ea56e6bc64a.exe 31 PID 1992 wrote to memory of 2576 1992 14a11a8a85f7d2d41de19ea56e6bc64a.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\14a11a8a85f7d2d41de19ea56e6bc64a.exe"C:\Users\Admin\AppData\Local\Temp\14a11a8a85f7d2d41de19ea56e6bc64a.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1992 -
C:\Program Files\360safe\2345safe.exe"C:\Program Files\360safe\2345safe.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1980
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\a.bat2⤵
- Deletes itself
PID:2576
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
86B
MD548ca6a416227d6b3b93fc1bc489b255f
SHA1d7998f8c8e0a702c603786420c9147ca567ec2a9
SHA2565c9e5bdd9d695a2763b11cf7554ff3dec8f476e51811fc2f4325f469ce118c68
SHA512a74e5161692c4b06c28b4cbe46dbd86e05e34937ed4b8d98836f28a331947cfeecfd0c8f5a5a2e49bc922ddf4283ec25694b3f920f9c7a9a1268fd5f079f4600
-
Filesize
86KB
MD514a11a8a85f7d2d41de19ea56e6bc64a
SHA18acb750730ead9557005fa667581155c5b6bd533
SHA25644649fe1bb4d6f546909b1514fc53d02e19a5ed43f1a7bdb2f61072b9f8215a7
SHA51224759a4179af3eb6af78a1b54e1491ff71895af5025765a30f91533f3a9cb6698d8ab1dc33b3777b7b3f2ddd550c3f8954491a3027d14cff1deb39eecf847ad5