Analysis
-
max time kernel
145s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
08/01/2024, 04:12
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
4a6837a8b5cc5c018e8d04f173e4bb91.exe
Resource
win7-20231129-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
4a6837a8b5cc5c018e8d04f173e4bb91.exe
Resource
win10v2004-20231222-en
5 signatures
150 seconds
General
-
Target
4a6837a8b5cc5c018e8d04f173e4bb91.exe
-
Size
82KB
-
MD5
4a6837a8b5cc5c018e8d04f173e4bb91
-
SHA1
7450813d148e964abd5a7a5a7d72c6c3c25d67f0
-
SHA256
73ac6274a893dea6fcd3d0eb1a465ebe9138d99c3ad931484cd393cf579fb723
-
SHA512
52cfe81eaa0baa43757381d71b9a52f0ff17eb15852551e1d1e925249a814ffe2ebfff0e11a8a47d09d80a47cc9d01c1699721eee3b652ce7ef1de71858fede1
-
SSDEEP
1536:4rDuib/cUuIT8Ml3RtUS2LCSwyc1HzOsvvYzDzNbx:f0cUvTftD24p1HzbYzv7
Score
7/10
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 1140 4a6837a8b5cc5c018e8d04f173e4bb91.exe -
Executes dropped EXE 1 IoCs
pid Process 1140 4a6837a8b5cc5c018e8d04f173e4bb91.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 2436 4a6837a8b5cc5c018e8d04f173e4bb91.exe -
Suspicious use of UnmapMainImage 2 IoCs
pid Process 2436 4a6837a8b5cc5c018e8d04f173e4bb91.exe 1140 4a6837a8b5cc5c018e8d04f173e4bb91.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2436 wrote to memory of 1140 2436 4a6837a8b5cc5c018e8d04f173e4bb91.exe 20 PID 2436 wrote to memory of 1140 2436 4a6837a8b5cc5c018e8d04f173e4bb91.exe 20 PID 2436 wrote to memory of 1140 2436 4a6837a8b5cc5c018e8d04f173e4bb91.exe 20
Processes
-
C:\Users\Admin\AppData\Local\Temp\4a6837a8b5cc5c018e8d04f173e4bb91.exeC:\Users\Admin\AppData\Local\Temp\4a6837a8b5cc5c018e8d04f173e4bb91.exe1⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
PID:1140
-
C:\Users\Admin\AppData\Local\Temp\4a6837a8b5cc5c018e8d04f173e4bb91.exe"C:\Users\Admin\AppData\Local\Temp\4a6837a8b5cc5c018e8d04f173e4bb91.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2436