Analysis
-
max time kernel
145s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
31/12/2023, 05:52
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2abea328cbf2d9f375e26f2d66424c11.exe
Resource
win7-20231215-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2abea328cbf2d9f375e26f2d66424c11.exe
Resource
win10v2004-20231215-en
5 signatures
150 seconds
General
-
Target
2abea328cbf2d9f375e26f2d66424c11.exe
-
Size
82KB
-
MD5
2abea328cbf2d9f375e26f2d66424c11
-
SHA1
92a37b01e402913a55a8b0ec0979705adba050c1
-
SHA256
6e0438e0477addffb16e4fa4bdff89cae248c5af6052e6454ec75901f020f851
-
SHA512
6af061880faf20c9ad5829553862423ac1156941316a16c76c0f9ac036ec574b7d55be303a550df2be87665035588d39cb7189c9e951175c78bbefd24b807f3b
-
SSDEEP
1536:+e/+qJovL1ShWdvqGd9/xnmSYbQt5EWDKFkNOGZrXxz3kjjE:TohD5qkt2WDKGNrFQjE
Score
7/10
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 4632 2abea328cbf2d9f375e26f2d66424c11.exe -
Executes dropped EXE 1 IoCs
pid Process 4632 2abea328cbf2d9f375e26f2d66424c11.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 1052 2abea328cbf2d9f375e26f2d66424c11.exe -
Suspicious use of UnmapMainImage 2 IoCs
pid Process 1052 2abea328cbf2d9f375e26f2d66424c11.exe 4632 2abea328cbf2d9f375e26f2d66424c11.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1052 wrote to memory of 4632 1052 2abea328cbf2d9f375e26f2d66424c11.exe 19 PID 1052 wrote to memory of 4632 1052 2abea328cbf2d9f375e26f2d66424c11.exe 19 PID 1052 wrote to memory of 4632 1052 2abea328cbf2d9f375e26f2d66424c11.exe 19
Processes
-
C:\Users\Admin\AppData\Local\Temp\2abea328cbf2d9f375e26f2d66424c11.exe"C:\Users\Admin\AppData\Local\Temp\2abea328cbf2d9f375e26f2d66424c11.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1052 -
C:\Users\Admin\AppData\Local\Temp\2abea328cbf2d9f375e26f2d66424c11.exeC:\Users\Admin\AppData\Local\Temp\2abea328cbf2d9f375e26f2d66424c11.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
PID:4632
-