Analysis
-
max time kernel
140s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
21-01-2024 06:20
Static task
static1
Behavioral task
behavioral1
Sample
6c93470ea27ceae5a407ed803c83267f.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
6c93470ea27ceae5a407ed803c83267f.exe
Resource
win10v2004-20231222-en
General
-
Target
6c93470ea27ceae5a407ed803c83267f.exe
-
Size
2.7MB
-
MD5
6c93470ea27ceae5a407ed803c83267f
-
SHA1
33d95a5e6a0298f2defe2bd9c6f38941d53c3ffd
-
SHA256
8537bdae683fb7ce6492e90cde36c71d07e225b7da0be9cfb0e67a00d28b523b
-
SHA512
a3227a555c1f3bf44a84945993ff965857abe22448609bea97c7562a55baea3b61d2de554abddce42f7f00da876a4fe13ebce77a383b49da7e9a21de0757ff01
-
SSDEEP
49152:M2GWDVn768A4JmaTfMO1hvuxZ1gNYnDzjA9ntyLqp475M+eYvRskLd1qapcqM:hF7634Jh4EWb8nsL/75M+eY53d1Ze
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
6c93470ea27ceae5a407ed803c83267f.tmppid process 2424 6c93470ea27ceae5a407ed803c83267f.tmp -
Loads dropped DLL 3 IoCs
Processes:
6c93470ea27ceae5a407ed803c83267f.exe6c93470ea27ceae5a407ed803c83267f.tmppid process 2308 6c93470ea27ceae5a407ed803c83267f.exe 2424 6c93470ea27ceae5a407ed803c83267f.tmp 2424 6c93470ea27ceae5a407ed803c83267f.tmp -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
6c93470ea27ceae5a407ed803c83267f.tmppid process 2424 6c93470ea27ceae5a407ed803c83267f.tmp -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
6c93470ea27ceae5a407ed803c83267f.exedescription pid process target process PID 2308 wrote to memory of 2424 2308 6c93470ea27ceae5a407ed803c83267f.exe 6c93470ea27ceae5a407ed803c83267f.tmp PID 2308 wrote to memory of 2424 2308 6c93470ea27ceae5a407ed803c83267f.exe 6c93470ea27ceae5a407ed803c83267f.tmp PID 2308 wrote to memory of 2424 2308 6c93470ea27ceae5a407ed803c83267f.exe 6c93470ea27ceae5a407ed803c83267f.tmp PID 2308 wrote to memory of 2424 2308 6c93470ea27ceae5a407ed803c83267f.exe 6c93470ea27ceae5a407ed803c83267f.tmp PID 2308 wrote to memory of 2424 2308 6c93470ea27ceae5a407ed803c83267f.exe 6c93470ea27ceae5a407ed803c83267f.tmp PID 2308 wrote to memory of 2424 2308 6c93470ea27ceae5a407ed803c83267f.exe 6c93470ea27ceae5a407ed803c83267f.tmp PID 2308 wrote to memory of 2424 2308 6c93470ea27ceae5a407ed803c83267f.exe 6c93470ea27ceae5a407ed803c83267f.tmp
Processes
-
C:\Users\Admin\AppData\Local\Temp\6c93470ea27ceae5a407ed803c83267f.exe"C:\Users\Admin\AppData\Local\Temp\6c93470ea27ceae5a407ed803c83267f.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-L8R3U.tmp\6c93470ea27ceae5a407ed803c83267f.tmp"C:\Users\Admin\AppData\Local\Temp\is-L8R3U.tmp\6c93470ea27ceae5a407ed803c83267f.tmp" /SL5="$400EC,2585432,54272,C:\Users\Admin\AppData\Local\Temp\6c93470ea27ceae5a407ed803c83267f.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\is-L8R3U.tmp\6c93470ea27ceae5a407ed803c83267f.tmpFilesize
695KB
MD5620f32e56b46e90e8aee43febc59f6e3
SHA1d5edd63dd1390a1420b85f746e12a66625ae9354
SHA256bcc9d63213012bf25a37f48015e5f755d359f3b08d05d35319b03b4a72710730
SHA5128a9d2a2eb3891265cec379978399ad6c9b4bf3e12e0f381946b4390621b943b97fa04fbb87ad628652bd765b706eb2ff56001f24de24e9bcc487a59ca2f07d9c
-
\Users\Admin\AppData\Local\Temp\is-UIHU9.tmp\_isetup\_shfoldr.dllFilesize
22KB
MD592dc6ef532fbb4a5c3201469a5b5eb63
SHA13e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA2569884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA5129908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3
-
memory/2308-1-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/2308-16-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/2424-11-0x0000000000240000-0x0000000000241000-memory.dmpFilesize
4KB
-
memory/2424-17-0x0000000000400000-0x00000000004BD000-memory.dmpFilesize
756KB
-
memory/2424-20-0x0000000000240000-0x0000000000241000-memory.dmpFilesize
4KB