Analysis
-
max time kernel
137s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
10/01/2024, 00:30
Behavioral task
behavioral1
Sample
4f198a3dac602509e29e1a7f2b9447b3.exe
Resource
win7-20231215-en
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
4f198a3dac602509e29e1a7f2b9447b3.exe
Resource
win10v2004-20231222-en
6 signatures
150 seconds
General
-
Target
4f198a3dac602509e29e1a7f2b9447b3.exe
-
Size
1.3MB
-
MD5
4f198a3dac602509e29e1a7f2b9447b3
-
SHA1
78a94f26017f7154af3487543a494cf8e06b0e71
-
SHA256
f48fa382efddcc2fabf14c1b4396bcca101c1638b92c51d73ed6a00569188b7c
-
SHA512
b5f511bbd5b94d0cfc54e891640f8df9ce35feee6f4216ef9e0a40690d5d393cb648fd0b639fc3b0c4b3cf235cb42496f5de37f4fd08c60960438b1e9a6dac9c
-
SSDEEP
24576:h8wxtHizSIe5KDxGKadrTJdNrw9O+MxyVA/56w449Z65CvG:hTxNV5KUJTJrkI+MxyVA/5d+
Score
7/10
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 1612 4f198a3dac602509e29e1a7f2b9447b3.exe -
Executes dropped EXE 1 IoCs
pid Process 1612 4f198a3dac602509e29e1a7f2b9447b3.exe -
resource yara_rule behavioral2/memory/2800-0-0x0000000000400000-0x000000000086A000-memory.dmp upx behavioral2/memory/1612-16-0x0000000000400000-0x000000000086A000-memory.dmp upx -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 2800 4f198a3dac602509e29e1a7f2b9447b3.exe -
Suspicious use of UnmapMainImage 2 IoCs
pid Process 2800 4f198a3dac602509e29e1a7f2b9447b3.exe 1612 4f198a3dac602509e29e1a7f2b9447b3.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2800 wrote to memory of 1612 2800 4f198a3dac602509e29e1a7f2b9447b3.exe 16 PID 2800 wrote to memory of 1612 2800 4f198a3dac602509e29e1a7f2b9447b3.exe 16 PID 2800 wrote to memory of 1612 2800 4f198a3dac602509e29e1a7f2b9447b3.exe 16
Processes
-
C:\Users\Admin\AppData\Local\Temp\4f198a3dac602509e29e1a7f2b9447b3.exe"C:\Users\Admin\AppData\Local\Temp\4f198a3dac602509e29e1a7f2b9447b3.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2800 -
C:\Users\Admin\AppData\Local\Temp\4f198a3dac602509e29e1a7f2b9447b3.exeC:\Users\Admin\AppData\Local\Temp\4f198a3dac602509e29e1a7f2b9447b3.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
PID:1612
-