Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
30/12/2023, 09:34
Static task
static1
Behavioral task
behavioral1
Sample
14a11a8a85f7d2d41de19ea56e6bc64a.exe
Resource
win7-20231215-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
14a11a8a85f7d2d41de19ea56e6bc64a.exe
Resource
win10v2004-20231222-en
windows10-2004-x64
5 signatures
150 seconds
General
-
Target
14a11a8a85f7d2d41de19ea56e6bc64a.exe
-
Size
86KB
-
MD5
14a11a8a85f7d2d41de19ea56e6bc64a
-
SHA1
8acb750730ead9557005fa667581155c5b6bd533
-
SHA256
44649fe1bb4d6f546909b1514fc53d02e19a5ed43f1a7bdb2f61072b9f8215a7
-
SHA512
24759a4179af3eb6af78a1b54e1491ff71895af5025765a30f91533f3a9cb6698d8ab1dc33b3777b7b3f2ddd550c3f8954491a3027d14cff1deb39eecf847ad5
-
SSDEEP
768:/2TTcTlj6JCcBEJU1HOvwBfzxQiL6DTl1IWJdM:/2TIN6JCcBTHPiiL6DkmdM
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1880 2345safe.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File opened for modification C:\Program Files\360safe\2345safe.exe 14a11a8a85f7d2d41de19ea56e6bc64a.exe File created C:\Program Files\360safe\2345safe.exe 14a11a8a85f7d2d41de19ea56e6bc64a.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5024 14a11a8a85f7d2d41de19ea56e6bc64a.exe 5024 14a11a8a85f7d2d41de19ea56e6bc64a.exe 5024 14a11a8a85f7d2d41de19ea56e6bc64a.exe 5024 14a11a8a85f7d2d41de19ea56e6bc64a.exe 5024 14a11a8a85f7d2d41de19ea56e6bc64a.exe 5024 14a11a8a85f7d2d41de19ea56e6bc64a.exe 5024 14a11a8a85f7d2d41de19ea56e6bc64a.exe 5024 14a11a8a85f7d2d41de19ea56e6bc64a.exe 5024 14a11a8a85f7d2d41de19ea56e6bc64a.exe 5024 14a11a8a85f7d2d41de19ea56e6bc64a.exe 5024 14a11a8a85f7d2d41de19ea56e6bc64a.exe 5024 14a11a8a85f7d2d41de19ea56e6bc64a.exe 5024 14a11a8a85f7d2d41de19ea56e6bc64a.exe 5024 14a11a8a85f7d2d41de19ea56e6bc64a.exe 5024 14a11a8a85f7d2d41de19ea56e6bc64a.exe 5024 14a11a8a85f7d2d41de19ea56e6bc64a.exe 5024 14a11a8a85f7d2d41de19ea56e6bc64a.exe 5024 14a11a8a85f7d2d41de19ea56e6bc64a.exe 5024 14a11a8a85f7d2d41de19ea56e6bc64a.exe 5024 14a11a8a85f7d2d41de19ea56e6bc64a.exe 5024 14a11a8a85f7d2d41de19ea56e6bc64a.exe 5024 14a11a8a85f7d2d41de19ea56e6bc64a.exe 5024 14a11a8a85f7d2d41de19ea56e6bc64a.exe 5024 14a11a8a85f7d2d41de19ea56e6bc64a.exe 5024 14a11a8a85f7d2d41de19ea56e6bc64a.exe 5024 14a11a8a85f7d2d41de19ea56e6bc64a.exe 5024 14a11a8a85f7d2d41de19ea56e6bc64a.exe 5024 14a11a8a85f7d2d41de19ea56e6bc64a.exe 5024 14a11a8a85f7d2d41de19ea56e6bc64a.exe 5024 14a11a8a85f7d2d41de19ea56e6bc64a.exe 5024 14a11a8a85f7d2d41de19ea56e6bc64a.exe 5024 14a11a8a85f7d2d41de19ea56e6bc64a.exe 5024 14a11a8a85f7d2d41de19ea56e6bc64a.exe 5024 14a11a8a85f7d2d41de19ea56e6bc64a.exe 5024 14a11a8a85f7d2d41de19ea56e6bc64a.exe 5024 14a11a8a85f7d2d41de19ea56e6bc64a.exe 5024 14a11a8a85f7d2d41de19ea56e6bc64a.exe 5024 14a11a8a85f7d2d41de19ea56e6bc64a.exe 5024 14a11a8a85f7d2d41de19ea56e6bc64a.exe 5024 14a11a8a85f7d2d41de19ea56e6bc64a.exe 5024 14a11a8a85f7d2d41de19ea56e6bc64a.exe 5024 14a11a8a85f7d2d41de19ea56e6bc64a.exe 5024 14a11a8a85f7d2d41de19ea56e6bc64a.exe 5024 14a11a8a85f7d2d41de19ea56e6bc64a.exe 5024 14a11a8a85f7d2d41de19ea56e6bc64a.exe 5024 14a11a8a85f7d2d41de19ea56e6bc64a.exe 5024 14a11a8a85f7d2d41de19ea56e6bc64a.exe 5024 14a11a8a85f7d2d41de19ea56e6bc64a.exe 5024 14a11a8a85f7d2d41de19ea56e6bc64a.exe 5024 14a11a8a85f7d2d41de19ea56e6bc64a.exe 5024 14a11a8a85f7d2d41de19ea56e6bc64a.exe 5024 14a11a8a85f7d2d41de19ea56e6bc64a.exe 5024 14a11a8a85f7d2d41de19ea56e6bc64a.exe 5024 14a11a8a85f7d2d41de19ea56e6bc64a.exe 5024 14a11a8a85f7d2d41de19ea56e6bc64a.exe 5024 14a11a8a85f7d2d41de19ea56e6bc64a.exe 5024 14a11a8a85f7d2d41de19ea56e6bc64a.exe 5024 14a11a8a85f7d2d41de19ea56e6bc64a.exe 5024 14a11a8a85f7d2d41de19ea56e6bc64a.exe 5024 14a11a8a85f7d2d41de19ea56e6bc64a.exe 5024 14a11a8a85f7d2d41de19ea56e6bc64a.exe 5024 14a11a8a85f7d2d41de19ea56e6bc64a.exe 5024 14a11a8a85f7d2d41de19ea56e6bc64a.exe 5024 14a11a8a85f7d2d41de19ea56e6bc64a.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 5024 14a11a8a85f7d2d41de19ea56e6bc64a.exe 1880 2345safe.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 5024 wrote to memory of 1880 5024 14a11a8a85f7d2d41de19ea56e6bc64a.exe 100 PID 5024 wrote to memory of 1880 5024 14a11a8a85f7d2d41de19ea56e6bc64a.exe 100 PID 5024 wrote to memory of 1880 5024 14a11a8a85f7d2d41de19ea56e6bc64a.exe 100 PID 5024 wrote to memory of 3380 5024 14a11a8a85f7d2d41de19ea56e6bc64a.exe 101 PID 5024 wrote to memory of 3380 5024 14a11a8a85f7d2d41de19ea56e6bc64a.exe 101 PID 5024 wrote to memory of 3380 5024 14a11a8a85f7d2d41de19ea56e6bc64a.exe 101
Processes
-
C:\Users\Admin\AppData\Local\Temp\14a11a8a85f7d2d41de19ea56e6bc64a.exe"C:\Users\Admin\AppData\Local\Temp\14a11a8a85f7d2d41de19ea56e6bc64a.exe"1⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5024 -
C:\Program Files\360safe\2345safe.exe"C:\Program Files\360safe\2345safe.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1880
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\a.bat2⤵PID:3380
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
86KB
MD514a11a8a85f7d2d41de19ea56e6bc64a
SHA18acb750730ead9557005fa667581155c5b6bd533
SHA25644649fe1bb4d6f546909b1514fc53d02e19a5ed43f1a7bdb2f61072b9f8215a7
SHA51224759a4179af3eb6af78a1b54e1491ff71895af5025765a30f91533f3a9cb6698d8ab1dc33b3777b7b3f2ddd550c3f8954491a3027d14cff1deb39eecf847ad5
-
Filesize
86B
MD548ca6a416227d6b3b93fc1bc489b255f
SHA1d7998f8c8e0a702c603786420c9147ca567ec2a9
SHA2565c9e5bdd9d695a2763b11cf7554ff3dec8f476e51811fc2f4325f469ce118c68
SHA512a74e5161692c4b06c28b4cbe46dbd86e05e34937ed4b8d98836f28a331947cfeecfd0c8f5a5a2e49bc922ddf4283ec25694b3f920f9c7a9a1268fd5f079f4600