Overview

overview

7

Static

static

3

18bad8c9b9...85.exe

windows7-x64

7

18bad8c9b9...85.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    122s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    30-12-2023 12:36

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    18bad8c9b9f503947371b3c3dec30c85.exe

  • Size

    1.9MB

  • MD5

    18bad8c9b9f503947371b3c3dec30c85

  • SHA1

    af68a6d330c6744a0d7f888567c484cddb2b27b3

  • SHA256

    f0edd371938cacc185a3fe79762a84bb098657982b2c567c9baa463bba5d8842

  • SHA512

    dc301376cae3ab491c39a44902cb58433830cf62a5173513f7d26e2a88ff63176b6ccd83e52342a541180afafcf252d63258671ea7eca6c28d65570552b7d2d2

  • SSDEEP

    24576:N2oo60HPdt+1CRiY2eOBvcj3u10dxtUiOb473eyTHS+hV7A70PduYDB1RNZ:Qoa1taC070dxtUiYilTHS+hhAuDB1RX

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\18bad8c9b9f503947371b3c3dec30c85.exe
    "C:\Users\Admin\AppData\Local\Temp\18bad8c9b9f503947371b3c3dec30c85.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2184
    • C:\Users\Admin\AppData\Local\Temp\119D.tmp
      "C:\Users\Admin\AppData\Local\Temp\119D.tmp" --splashC:\Users\Admin\AppData\Local\Temp\18bad8c9b9f503947371b3c3dec30c85.exe 6CAB4954A4E44072AAB6625F768D42B39467DC4FD7AADFEAF74C340B0DBD1E3B340A3D469C4D5C81E48CC0493794DF54706264F17550B0D8FBB97B484BFB4CE6
      2⤵
      • Deletes itself
      • Executes dropped EXE
      PID:2040

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\119D.tmp
    Filesize

    1.9MB

    MD5

    4edcde0108c0a9daffc84c159b777953

    SHA1

    9f2bd59f25dd2027f5706ea60b412319fefb3480

    SHA256

    2fb9ceae5965380a163b535f2a11c9ad23458c19507e42617424a131a3f4915c

    SHA512

    a6f2defb59f150a01044fb59228c3cc4144689fcd2311b83c7ed05159c4d6b05eacfa8f643f97ce0992edea09961fb4fb8c379ef8e084f13b37bf70dd7b0286e

    Download Submit

  • memory/2040-6-0x0000000000400000-0x00000000005E6000-memory.dmp

    Filesize

    1.9MB

    Download

  • memory/2184-0-0x0000000000400000-0x00000000005E6000-memory.dmp

    Filesize

    1.9MB

    Download