Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
08/01/2024, 04:12
Static task
static1
Behavioral task
behavioral1
Sample
4a6837a8b5cc5c018e8d04f173e4bb91.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
4a6837a8b5cc5c018e8d04f173e4bb91.exe
Resource
win10v2004-20231222-en
General
-
Target
4a6837a8b5cc5c018e8d04f173e4bb91.exe
-
Size
82KB
-
MD5
4a6837a8b5cc5c018e8d04f173e4bb91
-
SHA1
7450813d148e964abd5a7a5a7d72c6c3c25d67f0
-
SHA256
73ac6274a893dea6fcd3d0eb1a465ebe9138d99c3ad931484cd393cf579fb723
-
SHA512
52cfe81eaa0baa43757381d71b9a52f0ff17eb15852551e1d1e925249a814ffe2ebfff0e11a8a47d09d80a47cc9d01c1699721eee3b652ce7ef1de71858fede1
-
SSDEEP
1536:4rDuib/cUuIT8Ml3RtUS2LCSwyc1HzOsvvYzDzNbx:f0cUvTftD24p1HzbYzv7
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2352 4a6837a8b5cc5c018e8d04f173e4bb91.exe -
Executes dropped EXE 1 IoCs
pid Process 2352 4a6837a8b5cc5c018e8d04f173e4bb91.exe -
Loads dropped DLL 1 IoCs
pid Process 2732 4a6837a8b5cc5c018e8d04f173e4bb91.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 2732 4a6837a8b5cc5c018e8d04f173e4bb91.exe -
Suspicious use of UnmapMainImage 2 IoCs
pid Process 2732 4a6837a8b5cc5c018e8d04f173e4bb91.exe 2352 4a6837a8b5cc5c018e8d04f173e4bb91.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2732 wrote to memory of 2352 2732 4a6837a8b5cc5c018e8d04f173e4bb91.exe 29 PID 2732 wrote to memory of 2352 2732 4a6837a8b5cc5c018e8d04f173e4bb91.exe 29 PID 2732 wrote to memory of 2352 2732 4a6837a8b5cc5c018e8d04f173e4bb91.exe 29 PID 2732 wrote to memory of 2352 2732 4a6837a8b5cc5c018e8d04f173e4bb91.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\4a6837a8b5cc5c018e8d04f173e4bb91.exe"C:\Users\Admin\AppData\Local\Temp\4a6837a8b5cc5c018e8d04f173e4bb91.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\Users\Admin\AppData\Local\Temp\4a6837a8b5cc5c018e8d04f173e4bb91.exeC:\Users\Admin\AppData\Local\Temp\4a6837a8b5cc5c018e8d04f173e4bb91.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
PID:2352
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
82KB
MD5eb653de9002b9be138f06fc833564b2c
SHA11316ec7f4d971ad0db48286659e5cc15d4a94124
SHA2567a4d7fb1cf5feb7c6c3c66cfcb228a64f213a3544669b145e97243c4cebcba91
SHA5125842591eafc31466d902f00fa8f04ee25e0bbeb6720ae6dd9c430f719375a881a047347d72340917cf68e5ab821ab9de0b8c4d4f2beb971cbf19952bc5b6c148