Analysis

  • max time kernel
    138s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19/01/2024, 14:05

General

  • Target

    67cefb05fb757b085ea789a28bc67ab1.exe

  • Size

    409KB

  • MD5

    67cefb05fb757b085ea789a28bc67ab1

  • SHA1

    d4de55a1f735ea12896831c7f4b7fccd585e1579

  • SHA256

    ffde185d79483ef876fc7c541115d52ed6a23dd2562ec9ebee051a559fc7f885

  • SHA512

    af6d2d5f0b6c70d4d036bcc73d9e653bdab1727bf1eff640fd86f1edcc4851b59b52b814e1cf0629eefec556b094d7054017808228350bd15a26e7b27e38d690

  • SSDEEP

    6144:Flix0jXsQiW14SAEly53hS4s88JBF8lo7/KiiT9cVKooiihLpQJt2iBOE9QOlKt1:FEx0Fomy5x6fMCD9QOlKVdYs1KHcUsay

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\67cefb05fb757b085ea789a28bc67ab1.exe
    "C:\Users\Admin\AppData\Local\Temp\67cefb05fb757b085ea789a28bc67ab1.exe"
    1⤵
    • Suspicious behavior: RenamesItself
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:4720
    • C:\Users\Admin\AppData\Local\Temp\67cefb05fb757b085ea789a28bc67ab1.exe
      C:\Users\Admin\AppData\Local\Temp\67cefb05fb757b085ea789a28bc67ab1.exe
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Suspicious use of UnmapMainImage
      PID:1448

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\67cefb05fb757b085ea789a28bc67ab1.exe

          Filesize

          409KB

          MD5

          63c3f5185599bce1d163b896c68a6d9b

          SHA1

          7fd88bb146a53b0133227ea316c644104b066546

          SHA256

          09f470b59b9094606730d68fc8f39a5aa8063689c42bd2664324f87411486a5d

          SHA512

          6617db36f6eaf23569eaf2c3907066d2271df0c7786c07dfdd907b9a1e319cca801d78fbe9319ca43c407d67792efa887e0ab22d1a08ffacd1f1bc95fec2db64

        • memory/1448-13-0x0000000000400000-0x0000000000439000-memory.dmp

          Filesize

          228KB

        • memory/1448-14-0x00000000000F0000-0x0000000000129000-memory.dmp

          Filesize

          228KB

        • memory/1448-20-0x0000000000400000-0x000000000040E000-memory.dmp

          Filesize

          56KB

        • memory/1448-22-0x0000000001520000-0x0000000001552000-memory.dmp

          Filesize

          200KB

        • memory/4720-0-0x0000000000400000-0x0000000000439000-memory.dmp

          Filesize

          228KB

        • memory/4720-1-0x0000000001440000-0x0000000001479000-memory.dmp

          Filesize

          228KB

        • memory/4720-2-0x0000000000400000-0x0000000000432000-memory.dmp

          Filesize

          200KB

        • memory/4720-11-0x0000000000400000-0x0000000000432000-memory.dmp

          Filesize

          200KB