Analysis
-
max time kernel
148s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
11/01/2024, 16:00
Static task
static1
Behavioral task
behavioral1
Sample
53f4be8f2395999af67a5a67d634c84b.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
53f4be8f2395999af67a5a67d634c84b.exe
Resource
win10v2004-20231215-en
General
-
Target
53f4be8f2395999af67a5a67d634c84b.exe
-
Size
81KB
-
MD5
53f4be8f2395999af67a5a67d634c84b
-
SHA1
9dc7aaf422970cbdfe926a1a0e2edd0d50b1c572
-
SHA256
848bc546d96d50dfb98bac6b81bdc5a2ff99c3e43b20ec8cade1b365f8ee416a
-
SHA512
0f7a4782264f9853b27ce1e1f4772e610291c86bf2cb6d94d6f2340d8c3257e2ebcbd4fbe1cc47c3f2b21b0710a37d2ea2477df12b50e16a1f4860275754cdcc
-
SSDEEP
1536:DNu2rORchMRO8GzCVOROvHgOksd16Azn5E/9:DNDiPRwz0HgOksd0+I
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 3092 53f4be8f2395999af67a5a67d634c84b.exe -
Executes dropped EXE 1 IoCs
pid Process 3092 53f4be8f2395999af67a5a67d634c84b.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 3832 53f4be8f2395999af67a5a67d634c84b.exe -
Suspicious use of UnmapMainImage 2 IoCs
pid Process 3832 53f4be8f2395999af67a5a67d634c84b.exe 3092 53f4be8f2395999af67a5a67d634c84b.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3832 wrote to memory of 3092 3832 53f4be8f2395999af67a5a67d634c84b.exe 95 PID 3832 wrote to memory of 3092 3832 53f4be8f2395999af67a5a67d634c84b.exe 95 PID 3832 wrote to memory of 3092 3832 53f4be8f2395999af67a5a67d634c84b.exe 95
Processes
-
C:\Users\Admin\AppData\Local\Temp\53f4be8f2395999af67a5a67d634c84b.exe"C:\Users\Admin\AppData\Local\Temp\53f4be8f2395999af67a5a67d634c84b.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3832 -
C:\Users\Admin\AppData\Local\Temp\53f4be8f2395999af67a5a67d634c84b.exeC:\Users\Admin\AppData\Local\Temp\53f4be8f2395999af67a5a67d634c84b.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
PID:3092
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
81KB
MD59fa103ade903b18f931a81ebfb027158
SHA1f37ca1498c1c44786653cd2cd69cdaae8a3a7f69
SHA256cccfb283333f5e8145d352322aa9dfb7691cdae2554a28e4ddd172892e2c1061
SHA512c1c29c740bcf05f2df1679de6e7fc66e2ec353583412bb6a231b6e60a45c752f6a485cc82c4ff756b67a3311cc7857162903ebf6d7520386ce20c3f03fd35bf3