Analysis
-
max time kernel
141s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
31/12/2023, 01:52
Static task
static1
Behavioral task
behavioral1
Sample
236e5a537698a863f7cdbbf55b7d07e9.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
236e5a537698a863f7cdbbf55b7d07e9.exe
Resource
win10v2004-20231222-en
General
-
Target
236e5a537698a863f7cdbbf55b7d07e9.exe
-
Size
3.8MB
-
MD5
236e5a537698a863f7cdbbf55b7d07e9
-
SHA1
3e4836a8c2abdfa090a2ae2b5b95838af7d9553f
-
SHA256
fa87f3493dae78755ce86263010cbae5f0680e9a950ab3470945cebc217b38a4
-
SHA512
4946f511d950c7c087770b2f181c9341bd0d3a1f0ee99bcd62a16c2aa48332b475f4588cfbce2d7cdbb0923272e22848d9241b5cf53a655c419065529e2e77cc
-
SSDEEP
98304:XotohLakqQxZsA1zU7en9DoPnQiQDTtYLBF7ZXsi+Xl+I+AoSRgB:jNaDqJ147uAnQZDpYLB3XjmQpQgB
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1292 236e5a537698a863f7cdbbf55b7d07e9.tmp -
Loads dropped DLL 3 IoCs
pid Process 1204 236e5a537698a863f7cdbbf55b7d07e9.exe 1292 236e5a537698a863f7cdbbf55b7d07e9.tmp 1292 236e5a537698a863f7cdbbf55b7d07e9.tmp -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1292 236e5a537698a863f7cdbbf55b7d07e9.tmp -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1204 wrote to memory of 1292 1204 236e5a537698a863f7cdbbf55b7d07e9.exe 28 PID 1204 wrote to memory of 1292 1204 236e5a537698a863f7cdbbf55b7d07e9.exe 28 PID 1204 wrote to memory of 1292 1204 236e5a537698a863f7cdbbf55b7d07e9.exe 28 PID 1204 wrote to memory of 1292 1204 236e5a537698a863f7cdbbf55b7d07e9.exe 28 PID 1204 wrote to memory of 1292 1204 236e5a537698a863f7cdbbf55b7d07e9.exe 28 PID 1204 wrote to memory of 1292 1204 236e5a537698a863f7cdbbf55b7d07e9.exe 28 PID 1204 wrote to memory of 1292 1204 236e5a537698a863f7cdbbf55b7d07e9.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\236e5a537698a863f7cdbbf55b7d07e9.exe"C:\Users\Admin\AppData\Local\Temp\236e5a537698a863f7cdbbf55b7d07e9.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1204 -
C:\Users\Admin\AppData\Local\Temp\is-JPL4N.tmp\236e5a537698a863f7cdbbf55b7d07e9.tmp"C:\Users\Admin\AppData\Local\Temp\is-JPL4N.tmp\236e5a537698a863f7cdbbf55b7d07e9.tmp" /SL5="$7011E,3741557,54272,C:\Users\Admin\AppData\Local\Temp\236e5a537698a863f7cdbbf55b7d07e9.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
PID:1292
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
22KB
MD592dc6ef532fbb4a5c3201469a5b5eb63
SHA13e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA2569884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA5129908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3
-
Filesize
688KB
MD5c765336f0dcf4efdcc2101eed67cd30c
SHA1fa0279f59738c5aa3b6b20106e109ccd77f895a7
SHA256c5177fdc6031728e10141745cd69edbc91c92d14411a2dec6e8e8caa4f74ab28
SHA51206a67ac37c20897967e2cad453793a6ef1c7804d4c578404f845daa88c859b15b0acb51642e6ad23ca6ba6549b02d5f6c98b1fa402004bdbf9d646abab7ec891