e799f2ec520a00fb3d58550d30ae036e522cf2a1dc3acb24c27db272444703e0

Analysis

max time kernel
145s
max time network
146s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 06:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2b5c8149e000ac081ba5ddb6dab02a0e.exe
Size

44KB
MD5

2b5c8149e000ac081ba5ddb6dab02a0e
SHA1

b87b2cc2c7e0a0d6162773c6dcbb2a733ebe30e5
SHA256

e799f2ec520a00fb3d58550d30ae036e522cf2a1dc3acb24c27db272444703e0
SHA512

0da80f8819c15c6ad73e1e139465e22fbc134ea04e16f74498eedc8c431e8535706fd554e6b991db7ceb45d2c80d6502582681e4cacc7d6097546021a8ced1fb
SSDEEP

768:ch9o4zItym1+nSCPt4Wo946J2rP8qCSNmJZHuhArFUdRBGrvvPE:coKIo0soO6ErWJZHurqrE

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2296	rundll32.sys

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1944 wrote to memory of 2340	1944	2b5c8149e000ac081ba5ddb6dab02a0e.exe	16
PID 1944 wrote to memory of 2340	1944	2b5c8149e000ac081ba5ddb6dab02a0e.exe	16
PID 1944 wrote to memory of 2340	1944	2b5c8149e000ac081ba5ddb6dab02a0e.exe	16
PID 1944 wrote to memory of 2340	1944	2b5c8149e000ac081ba5ddb6dab02a0e.exe	16

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
2340	attrib.exe

C:\ProgramData\rundll32.sys
C:\ProgramData\rundll32.sys
1⤵
- Executes dropped EXE
PID:2296

C:\Windows\SysWOW64\attrib.exe
attrib +h +s C:\ProgramData\rundll32.sys
1⤵
- Views/modifies file attributes
PID:2340

C:\Users\Admin\AppData\Local\Temp\2b5c8149e000ac081ba5ddb6dab02a0e.exe
"C:\Users\Admin\AppData\Local\Temp\2b5c8149e000ac081ba5ddb6dab02a0e.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1944

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads