Analysis
-
max time kernel
1s -
max time network
118s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
31/12/2023, 10:16
Behavioral task
behavioral1
Sample
325bbbe1ee2f09f72e1084acae849bf8.exe
Resource
win7-20231129-en
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
325bbbe1ee2f09f72e1084acae849bf8.exe
Resource
win10v2004-20231215-en
3 signatures
150 seconds
General
-
Target
325bbbe1ee2f09f72e1084acae849bf8.exe
-
Size
18.6MB
-
MD5
325bbbe1ee2f09f72e1084acae849bf8
-
SHA1
f75c355e3277410919f5c7b7436fbcaa8b86fce1
-
SHA256
c605e919a0b6a36830a388be8e43a29a81139d095cea8f04269a349872afdebe
-
SHA512
506685f3a72c3f489aaf239d7190893aa4ec89eceab12cf858bdfa237ee2883f1397432aa5fb9b8951bb6097ae0970685d44227fbca0f08e8f5371f5200bc79c
-
SSDEEP
393216:mAP1dyZTDeIRs4dpRhuGCTxhAQZTAkWNGgp:T1qDeIRLutt/TAt5
Score
7/10
Malware Config
Signatures
-
Loads dropped DLL 12 IoCs
pid Process 2728 325bbbe1ee2f09f72e1084acae849bf8.exe 2728 325bbbe1ee2f09f72e1084acae849bf8.exe 2728 325bbbe1ee2f09f72e1084acae849bf8.exe 2728 325bbbe1ee2f09f72e1084acae849bf8.exe 2728 325bbbe1ee2f09f72e1084acae849bf8.exe 2728 325bbbe1ee2f09f72e1084acae849bf8.exe 2728 325bbbe1ee2f09f72e1084acae849bf8.exe 2728 325bbbe1ee2f09f72e1084acae849bf8.exe 2728 325bbbe1ee2f09f72e1084acae849bf8.exe 2728 325bbbe1ee2f09f72e1084acae849bf8.exe 2728 325bbbe1ee2f09f72e1084acae849bf8.exe 2728 325bbbe1ee2f09f72e1084acae849bf8.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1228 wrote to memory of 2728 1228 325bbbe1ee2f09f72e1084acae849bf8.exe 33 PID 1228 wrote to memory of 2728 1228 325bbbe1ee2f09f72e1084acae849bf8.exe 33 PID 1228 wrote to memory of 2728 1228 325bbbe1ee2f09f72e1084acae849bf8.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\325bbbe1ee2f09f72e1084acae849bf8.exe"C:\Users\Admin\AppData\Local\Temp\325bbbe1ee2f09f72e1084acae849bf8.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1228 -
C:\Users\Admin\AppData\Local\Temp\325bbbe1ee2f09f72e1084acae849bf8.exe"C:\Users\Admin\AppData\Local\Temp\325bbbe1ee2f09f72e1084acae849bf8.exe"2⤵
- Loads dropped DLL
PID:2728
-
-
C:\Users\Admin\AppData\Local\Temp\325bbbe1ee2f09f72e1084acae849bf8.exe"C:\Users\Admin\AppData\Local\Temp\325bbbe1ee2f09f72e1084acae849bf8.exe" C:\Users\Admin\AppData\Local\Temp\325bbbe1ee2f09f72e1084acae849bf8.exe asadmin1⤵PID:1612
-
C:\Users\Admin\AppData\Local\Temp\325bbbe1ee2f09f72e1084acae849bf8.exe"C:\Users\Admin\AppData\Local\Temp\325bbbe1ee2f09f72e1084acae849bf8.exe" C:\Users\Admin\AppData\Local\Temp\325bbbe1ee2f09f72e1084acae849bf8.exe asadmin2⤵PID:4408
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Bypass.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Bypass.exe"1⤵PID:944
-
C:\Users\Admin\AppData\Local\Temp\Defender.exe"C:\Users\Admin\AppData\Local\Temp\Defender.exe" /D2⤵PID:4912
-