Analysis
-
max time kernel
164s -
max time network
174s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
08-01-2024 12:38
Behavioral task
behavioral1
Sample
4b75aa4b3e106ac8f0cb6d90ae50fd77.exe
Resource
win7-20231129-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
4b75aa4b3e106ac8f0cb6d90ae50fd77.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
6 signatures
150 seconds
General
-
Target
4b75aa4b3e106ac8f0cb6d90ae50fd77.exe
-
Size
4.8MB
-
MD5
4b75aa4b3e106ac8f0cb6d90ae50fd77
-
SHA1
ecb22b7708ad8bd06b411c3736736d601d59ec71
-
SHA256
944522347b3a3e48b075b6ee424fa2be8658fb20a85d6b3ee2ed0fe328f9ea1c
-
SHA512
3c1cf7fa816257f7908dc80a210f6d0440b85a669c384791a6f743b198f37084758230780c80788e44187f0b4d0c068c0d2373060a45f4f6718a029c2e1fddbd
-
SSDEEP
98304:VPl5fW9vz2isRgg3gnl/IVUs1j7h4Sd8ZxC4J/9/tax3hgg3gnl/IVUs1jr:V/O9L2iogl/iBxTAZ9Yxngl/iBP
Score
7/10
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 1604 4b75aa4b3e106ac8f0cb6d90ae50fd77.exe -
Executes dropped EXE 1 IoCs
pid Process 1604 4b75aa4b3e106ac8f0cb6d90ae50fd77.exe -
resource yara_rule behavioral2/memory/3152-0-0x0000000000400000-0x00000000008EF000-memory.dmp upx behavioral2/memory/1604-13-0x0000000000400000-0x00000000008EF000-memory.dmp upx -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 3152 4b75aa4b3e106ac8f0cb6d90ae50fd77.exe -
Suspicious use of UnmapMainImage 2 IoCs
pid Process 3152 4b75aa4b3e106ac8f0cb6d90ae50fd77.exe 1604 4b75aa4b3e106ac8f0cb6d90ae50fd77.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3152 wrote to memory of 1604 3152 4b75aa4b3e106ac8f0cb6d90ae50fd77.exe 51 PID 3152 wrote to memory of 1604 3152 4b75aa4b3e106ac8f0cb6d90ae50fd77.exe 51 PID 3152 wrote to memory of 1604 3152 4b75aa4b3e106ac8f0cb6d90ae50fd77.exe 51
Processes
-
C:\Users\Admin\AppData\Local\Temp\4b75aa4b3e106ac8f0cb6d90ae50fd77.exe"C:\Users\Admin\AppData\Local\Temp\4b75aa4b3e106ac8f0cb6d90ae50fd77.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3152 -
C:\Users\Admin\AppData\Local\Temp\4b75aa4b3e106ac8f0cb6d90ae50fd77.exeC:\Users\Admin\AppData\Local\Temp\4b75aa4b3e106ac8f0cb6d90ae50fd77.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
PID:1604
-