Analysis
-
max time kernel
202s -
max time network
157s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
09/01/2024, 06:40
Static task
static1
Behavioral task
behavioral1
Sample
4d9c362741d0813dc236ddf8a1b9f4b8.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
4d9c362741d0813dc236ddf8a1b9f4b8.exe
Resource
win10v2004-20231215-en
General
-
Target
4d9c362741d0813dc236ddf8a1b9f4b8.exe
-
Size
1.7MB
-
MD5
4d9c362741d0813dc236ddf8a1b9f4b8
-
SHA1
8c63d506f82817cca5f3ba0b5c787259b53000db
-
SHA256
7386c4fed9738237a80801bc14370686b3ebabd85f645c98dd757a78b3943e68
-
SHA512
e1310b66997d817b54b3295fb2d6d182936a29e9002ad039206c03e1ad73d0bd9875f6bc1b12ff7d10195a5637cf41176322346915a6e4ed90b2f0abc50fa52c
-
SSDEEP
49152:5aRzoztN7HRwVCf6GSljw3Vs/BqhEzyS+ggE4inXBgJ:QR8zvHRFvE468EOstRgJ
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2904 4d9c362741d0813dc236ddf8a1b9f4b8.tmp -
Loads dropped DLL 4 IoCs
pid Process 2620 4d9c362741d0813dc236ddf8a1b9f4b8.exe 2904 4d9c362741d0813dc236ddf8a1b9f4b8.tmp 2904 4d9c362741d0813dc236ddf8a1b9f4b8.tmp 2904 4d9c362741d0813dc236ddf8a1b9f4b8.tmp -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2620 wrote to memory of 2904 2620 4d9c362741d0813dc236ddf8a1b9f4b8.exe 29 PID 2620 wrote to memory of 2904 2620 4d9c362741d0813dc236ddf8a1b9f4b8.exe 29 PID 2620 wrote to memory of 2904 2620 4d9c362741d0813dc236ddf8a1b9f4b8.exe 29 PID 2620 wrote to memory of 2904 2620 4d9c362741d0813dc236ddf8a1b9f4b8.exe 29 PID 2620 wrote to memory of 2904 2620 4d9c362741d0813dc236ddf8a1b9f4b8.exe 29 PID 2620 wrote to memory of 2904 2620 4d9c362741d0813dc236ddf8a1b9f4b8.exe 29 PID 2620 wrote to memory of 2904 2620 4d9c362741d0813dc236ddf8a1b9f4b8.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\4d9c362741d0813dc236ddf8a1b9f4b8.exe"C:\Users\Admin\AppData\Local\Temp\4d9c362741d0813dc236ddf8a1b9f4b8.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2620 -
C:\Users\Admin\AppData\Local\Temp\is-3RJC1.tmp\4d9c362741d0813dc236ddf8a1b9f4b8.tmp"C:\Users\Admin\AppData\Local\Temp\is-3RJC1.tmp\4d9c362741d0813dc236ddf8a1b9f4b8.tmp" /SL5="$4016C,1480221,54272,C:\Users\Admin\AppData\Local\Temp\4d9c362741d0813dc236ddf8a1b9f4b8.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2904
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
207B
MD59f907411076f9d21e76b278a5b5e6c38
SHA1c6848c3a2153a91a26fa91322b55c9ad0c80c24e
SHA256099dd414a11071373f0e0a1ea469f59be4a608c12111e3e467b8e0d1a1af0783
SHA512446e997a8e1abd8156373e670415dabe1df7b58983afc2bdf20ec3339868999f85ea0e276e50cd981e47fa9cee52c83eb877c289e6e557798d561455f4b1ff6f
-
Filesize
688KB
MD5c765336f0dcf4efdcc2101eed67cd30c
SHA1fa0279f59738c5aa3b6b20106e109ccd77f895a7
SHA256c5177fdc6031728e10141745cd69edbc91c92d14411a2dec6e8e8caa4f74ab28
SHA51206a67ac37c20897967e2cad453793a6ef1c7804d4c578404f845daa88c859b15b0acb51642e6ad23ca6ba6549b02d5f6c98b1fa402004bdbf9d646abab7ec891
-
Filesize
22KB
MD592dc6ef532fbb4a5c3201469a5b5eb63
SHA13e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA2569884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA5129908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3
-
Filesize
49KB
MD502ecc74f7f91e9ffd84de708683236a6
SHA13532de0b77df8b0fc89e9c7eddec3fa71f98f5a2
SHA25630ad8a0e1cee091ca48c771adb2e76baf1a7d54b9f60dc47f54dfdc2d6f6691e
SHA512a3fdaa651f82428395bc412a2a04fce673768d3ef088b3748addf337d95464eb141ae7c286bff5c705eae05dd7b38207629588ae7e89ada15269463cd7acf541