Analysis
-
max time kernel
162s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
01-01-2024 04:32
Static task
static1
Behavioral task
behavioral1
Sample
3be6b109be72f3e9bae6d5c5a46eaa43.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
3be6b109be72f3e9bae6d5c5a46eaa43.exe
Resource
win10v2004-20231222-en
General
-
Target
3be6b109be72f3e9bae6d5c5a46eaa43.exe
-
Size
1.8MB
-
MD5
3be6b109be72f3e9bae6d5c5a46eaa43
-
SHA1
c2a7f36228861c661a18acb06ae0bbcf7263ae71
-
SHA256
d8d74701ba059feabce2c5b8e24eaa77ac95c27e266028e05f9b3f90092b5a1a
-
SHA512
83022df6a16c4f4b19b223fb80f1d1c1d3374535b04289679044bb286a3f187e1f4eebbf4c8ea3b17c442636450d9e56f0da208579b300b0a80717d91c1febbe
-
SSDEEP
49152:4yd4qWw2lrcW7iYsmBrYsDEOMql8q5lomNyi1aq:ZdJWHB8sEdqlf7h1X
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2344 3be6b109be72f3e9bae6d5c5a46eaa43.tmp -
Loads dropped DLL 1 IoCs
pid Process 2816 3be6b109be72f3e9bae6d5c5a46eaa43.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2344 3be6b109be72f3e9bae6d5c5a46eaa43.tmp -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2816 wrote to memory of 2344 2816 3be6b109be72f3e9bae6d5c5a46eaa43.exe 16 PID 2816 wrote to memory of 2344 2816 3be6b109be72f3e9bae6d5c5a46eaa43.exe 16 PID 2816 wrote to memory of 2344 2816 3be6b109be72f3e9bae6d5c5a46eaa43.exe 16 PID 2816 wrote to memory of 2344 2816 3be6b109be72f3e9bae6d5c5a46eaa43.exe 16 PID 2816 wrote to memory of 2344 2816 3be6b109be72f3e9bae6d5c5a46eaa43.exe 16 PID 2816 wrote to memory of 2344 2816 3be6b109be72f3e9bae6d5c5a46eaa43.exe 16 PID 2816 wrote to memory of 2344 2816 3be6b109be72f3e9bae6d5c5a46eaa43.exe 16
Processes
-
C:\Users\Admin\AppData\Local\Temp\3be6b109be72f3e9bae6d5c5a46eaa43.exe"C:\Users\Admin\AppData\Local\Temp\3be6b109be72f3e9bae6d5c5a46eaa43.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2816 -
C:\Users\Admin\AppData\Local\Temp\is-C7MC7.tmp\3be6b109be72f3e9bae6d5c5a46eaa43.tmp"C:\Users\Admin\AppData\Local\Temp\is-C7MC7.tmp\3be6b109be72f3e9bae6d5c5a46eaa43.tmp" /SL5="$70122,1624557,58368,C:\Users\Admin\AppData\Local\Temp\3be6b109be72f3e9bae6d5c5a46eaa43.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
PID:2344
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
6KB
MD5eca75ba92c046367fb159215583cf529
SHA14db5d351282d962d20df71697809275bfcdea4c6
SHA2561b1a86a500c523b3aa9b66a85d8b75c0671cecdb82f11d8f539d00743877d705
SHA51291035d7fa539101a7fd2acb549cba2ea4f8f853742587e029edd44276b425c3dbf7a21712d5777416346f17c01f30259a229fa0d3ccccda70fa8e03464f1e173
-
Filesize
24KB
MD535464230c78c281b66833e3ce93ffc45
SHA1de00e986a575a6cb0d32ca8b34cb193ee986e655
SHA256c884047bf649a246d392391110d7ac187db0f8fcec811853bdb756dfeafea0d5
SHA512130be13ebb9cf59b66a1ec343ebef8874fdefb46e35009ba6e7ed48584b5ecc37fbf2a0817ba9a9be3ecad16bb3b5081cafff7b1aff513b95580884265545bb3