Analysis
-
max time kernel
119s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
19/01/2024, 15:50
General
-
Target
680544c38e83ad7f8e8a4567d7ebd00a.exe
-
Size
82KB
-
MD5
680544c38e83ad7f8e8a4567d7ebd00a
-
SHA1
0224aae57492567daf9cee527f05a8369cb372c9
-
SHA256
f09c43b3713a37766c2e57e3eb322fca610821cdb6c025c607aa916cb62f707c
-
SHA512
3a30b16361aa19ee342d85eaa4060fed5eee2cf50bb595755de14742f0848d6b9010d28e4eb1a97d3d29cbcbfc52aa474611351bc7bfb5361887b8670f7263c4
-
SSDEEP
1536:h5QMctLSs9oyy5xv9cpR6WtmXoojE+36RFato0U5y+Br+fBgrU0ne3Ee:YMq9oXuKWb+3M82X5y+Braghe3r
Score
7/10
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\680544c38e83ad7f8e8a4567d7ebd00a.exe"C:\Users\Admin\AppData\Local\Temp\680544c38e83ad7f8e8a4567d7ebd00a.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\680544c38e83ad7f8e8a4567d7ebd00a.exeC:\Users\Admin\AppData\Local\Temp\680544c38e83ad7f8e8a4567d7ebd00a.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
82KB
MD56a9648974fe5eb43186467dde64a22a5
SHA1005217f1cc570e09202a03dedbc41b8bd9b65ea8
SHA256e315bb1bea055b8f6a6d0baf1f39211bb1bab050eaba9b7124c5018667552836
SHA5128a9b00aa119bf90f5b2fd7d4f6e76f2dfcc70cf43391db4143649b42107c31e224e78df414a01ccb5dd5c2eb69c0ebd7fba63a3425b668788db830947ac9b183
-
Filesize
188KB
-
Filesize
56KB
-
Filesize
108KB
-
Filesize
188KB
-
Filesize
108KB
-
Filesize
188KB
-
Filesize
188KB
-
Filesize
108KB