Analysis

  • max time kernel
    6s
  • max time network
    141s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    31/12/2023, 02:18

General

  • Target

    24409b7f282741a0c72c1fd6ed67bfa4.exe

  • Size

    907KB

  • MD5

    24409b7f282741a0c72c1fd6ed67bfa4

  • SHA1

    f3ef9b232909cc26cd80c5f4220c786ef67bf86a

  • SHA256

    752a95e1e96709f1f1eb6fed3a2e32df83d2a36086e2520057f83eac48502812

  • SHA512

    f8b76c12626f6c6047fc5d3a9a44605e257a132f68db90d02cf8d5cf13314682def7b4e026beeea0856b2eb27e7e9220c5fa175d5dbf15c722be73a95da7092d

  • SSDEEP

    24576:GO6ceGQqk6gaBHS1PQeRDM0x0aKuWQwq5Ca/ZS1:GFGQqkpaU9xC0qWCgS

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\24409b7f282741a0c72c1fd6ed67bfa4.exe
    "C:\Users\Admin\AppData\Local\Temp\24409b7f282741a0c72c1fd6ed67bfa4.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: RenamesItself
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:1488
    • C:\Users\Admin\AppData\Local\Temp\24409b7f282741a0c72c1fd6ed67bfa4.exe
      C:\Users\Admin\AppData\Local\Temp\24409b7f282741a0c72c1fd6ed67bfa4.exe
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Suspicious use of UnmapMainImage
      PID:2732

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\24409b7f282741a0c72c1fd6ed67bfa4.exe

          Filesize

          62KB

          MD5

          b44a08b35141fe9a4bc2541e3c4092c2

          SHA1

          97ac0fd117e224780d81c2d9f78b89314224d06c

          SHA256

          c8e5b4afa1f818e090b7342e9ec07841b52620f7d8cddabe21fae961e3b882bf

          SHA512

          3acb2b2c65a9604e03db0923abfccb5a92d5935bfc71e2453e025895179a5c3638034ee8181f9b3e14020f484d26959c6e9aa760e8ff903b0285b7eea27629e5

        • C:\Users\Admin\AppData\Local\Temp\CabAAF1.tmp

          Filesize

          46KB

          MD5

          cc25bd30d5cfc292a4733ed0a7852242

          SHA1

          e198c7a5820d7883050dfa5c929a626bf94ad15c

          SHA256

          c2cc192fcb789d545e999210f840e3de7ca3f0fbc57e7a512273e9e715442e9b

          SHA512

          045eb7e05b764f9f2aceffd74879d8c7f62790ee97b25c23b344c32a3e58e7efe16992fb9cdcc1f0bf8ff5ba0cf7dafc4cfb34e383394a69043101022e7c77a9

        • C:\Users\Admin\AppData\Local\Temp\TarAB13.tmp

          Filesize

          1KB

          MD5

          fa527dcd6b5eb05e72fc51570a2a6608

          SHA1

          3380c5ef74408265fba2f67e790636d0ad0a51cc

          SHA256

          4dc7a4a6cb3be2c334a27a49df89f18f8f91749fe6aa1cf28d548e0e0c75ce3d

          SHA512

          05c0e217c433949cab210102a26ca7f6a765515b228b217e25c7409408fc167b5a59a8494e1181284e9ec72849c90288f3a066faa284e29d871097ec76291a5a

        • \Users\Admin\AppData\Local\Temp\24409b7f282741a0c72c1fd6ed67bfa4.exe

          Filesize

          1KB

          MD5

          f0cafc83c4897062995c4c1111e28ea6

          SHA1

          7c0f0cd0ac67b41b88b9e61ff15a0406c2f4cb1a

          SHA256

          7b83d32fa2e2f9d60c103a67c3541cba70ec1f6454761a0457cb1de4b6086e72

          SHA512

          ae9ed519f1a5283ae508caaa4f2abf3b48f47c4dedae5b542b8b6c30079dac509edbaf492fe681aa5d357eb4933fd45538a751541ebd9c73560f5d1166af25df

        • memory/1488-12-0x0000000003260000-0x0000000003348000-memory.dmp

          Filesize

          928KB

        • memory/1488-15-0x0000000000400000-0x00000000004BB000-memory.dmp

          Filesize

          748KB

        • memory/1488-0-0x0000000000400000-0x00000000004E8000-memory.dmp

          Filesize

          928KB

        • memory/1488-1-0x0000000000400000-0x00000000004BB000-memory.dmp

          Filesize

          748KB

        • memory/1488-2-0x00000000014F0000-0x00000000015D8000-memory.dmp

          Filesize

          928KB

        • memory/2732-17-0x00000000015B0000-0x0000000001698000-memory.dmp

          Filesize

          928KB

        • memory/2732-23-0x0000000002F50000-0x000000000300B000-memory.dmp

          Filesize

          748KB

        • memory/2732-22-0x0000000000400000-0x0000000000498000-memory.dmp

          Filesize

          608KB

        • memory/2732-76-0x0000000000400000-0x0000000000443000-memory.dmp

          Filesize

          268KB

        • memory/2732-81-0x000000000EB00000-0x000000000EB98000-memory.dmp

          Filesize

          608KB