Analysis
-
max time kernel
147s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
31/12/2023, 12:41
General
-
Target
368134122ca1ba8173f3a07073cd32e3.exe
-
Size
519KB
-
MD5
368134122ca1ba8173f3a07073cd32e3
-
SHA1
b635dc8101a7fb6bb77f37df4e2cc828996ae8f3
-
SHA256
1ccb063e8fa4f6a38ebcc7959f4080b282944c4b7097289ca25edad9db6c4eb3
-
SHA512
53d29f149a8daf61e857321dc8a63f631fe7f21e7a85bc296af8f0b31b362445e740a860da2ed204dfb7d47836b5c1bf7b9ad2a2c8c341ab74c80e37ff75f5b9
-
SSDEEP
12288:VYXKTYHv624h6G33QW/LTnInrcpLT58B:klSvY87LTIYpLT+
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Drops file in System32 directory 6 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\368134122ca1ba8173f3a07073cd32e3.exe"C:\Users\Admin\AppData\Local\Temp\368134122ca1ba8173f3a07073cd32e3.exe"2⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat3⤵
-
-
-
C:\Windows\SysWOW64\mmspy.exeC:\Windows\SysWOW64\mmspy.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
184B
MD5082b24a75acb143ae44ede48f1c45961
SHA1392299cc774de8dc1a23b083147e8970ba53249a
SHA2560ae864b9b25fd1039303487ef69837f3f615e0f0678e88bebfaa185cb75c4a00
SHA512434fcd08dabcb2ca820846930e6b47e43cf82c2cfac990d05952f5837fc53020719ecc69ac6feb17aad93fd4876fcd6685437335500c786a9f37038c025647ac
-
Filesize
519KB
MD5368134122ca1ba8173f3a07073cd32e3
SHA1b635dc8101a7fb6bb77f37df4e2cc828996ae8f3
SHA2561ccb063e8fa4f6a38ebcc7959f4080b282944c4b7097289ca25edad9db6c4eb3
SHA51253d29f149a8daf61e857321dc8a63f631fe7f21e7a85bc296af8f0b31b362445e740a860da2ed204dfb7d47836b5c1bf7b9ad2a2c8c341ab74c80e37ff75f5b9
-
Filesize
548KB
-
Filesize
548KB