Analysis
-
max time kernel
142s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
25-01-2024 02:50
Static task
static1
Behavioral task
behavioral1
Sample
c9470058cca0e1cb82d4c0a07fecd0db.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
c9470058cca0e1cb82d4c0a07fecd0db.exe
Resource
win10v2004-20231215-en
General
-
Target
c9470058cca0e1cb82d4c0a07fecd0db.exe
-
Size
714KB
-
MD5
c9470058cca0e1cb82d4c0a07fecd0db
-
SHA1
a66d76d86448965e57d7be96a57529c497e4b99d
-
SHA256
fe2982abd3fbb02808da5892a6a262bccdd0b8650c79fb2d6e2f1fd401297da5
-
SHA512
ec8cc6b45e2703ee8c227a0fe7d3e1efb999ae0de583cc98e7ef7aa932f686fc06bea21081be19a2cc11e784ab7161129ecd7288bae971b4fce7fba44296388a
-
SSDEEP
12288:eo01IzLB/XV/tboClV+tFHxMfR+G1x2VK8PTkKE2qtFL/MLsJT5X:eLMb/xoClV+tFRMfRuk528L/M8T5X
Malware Config
Signatures
-
Deletes itself 1 IoCs
Processes:
.c9470058cca0e1cb82d4c0a07fecd0db.glmfxuwrzfiilfucejqfnaqhhspoific.__selfdelete__.exepid process 648 .c9470058cca0e1cb82d4c0a07fecd0db.glmfxuwrzfiilfucejqfnaqhhspoific.__selfdelete__.exe -
Executes dropped EXE 1 IoCs
Processes:
.c9470058cca0e1cb82d4c0a07fecd0db.glmfxuwrzfiilfucejqfnaqhhspoific.__selfdelete__.exepid process 648 .c9470058cca0e1cb82d4c0a07fecd0db.glmfxuwrzfiilfucejqfnaqhhspoific.__selfdelete__.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
c9470058cca0e1cb82d4c0a07fecd0db.exepid process 4864 c9470058cca0e1cb82d4c0a07fecd0db.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
c9470058cca0e1cb82d4c0a07fecd0db.exe.c9470058cca0e1cb82d4c0a07fecd0db.glmfxuwrzfiilfucejqfnaqhhspoific.__selfdelete__.exedescription pid process target process PID 4864 wrote to memory of 648 4864 c9470058cca0e1cb82d4c0a07fecd0db.exe .c9470058cca0e1cb82d4c0a07fecd0db.glmfxuwrzfiilfucejqfnaqhhspoific.__selfdelete__.exe PID 4864 wrote to memory of 648 4864 c9470058cca0e1cb82d4c0a07fecd0db.exe .c9470058cca0e1cb82d4c0a07fecd0db.glmfxuwrzfiilfucejqfnaqhhspoific.__selfdelete__.exe PID 648 wrote to memory of 4196 648 .c9470058cca0e1cb82d4c0a07fecd0db.glmfxuwrzfiilfucejqfnaqhhspoific.__selfdelete__.exe cmd.exe PID 648 wrote to memory of 4196 648 .c9470058cca0e1cb82d4c0a07fecd0db.glmfxuwrzfiilfucejqfnaqhhspoific.__selfdelete__.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c9470058cca0e1cb82d4c0a07fecd0db.exe"C:\Users\Admin\AppData\Local\Temp\c9470058cca0e1cb82d4c0a07fecd0db.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\.c9470058cca0e1cb82d4c0a07fecd0db.glmfxuwrzfiilfucejqfnaqhhspoific.__selfdelete__.exe"C:\Users\Admin\AppData\Local\Temp\.c9470058cca0e1cb82d4c0a07fecd0db.glmfxuwrzfiilfucejqfnaqhhspoific.__selfdelete__.exe" 460 C:\Users\Admin\AppData\Local\Temp\.c9470058cca0e1cb82d4c0a07fecd0db.pjewyjuxgczsgzjsjfjmrmpurcbywnty.__relocated__.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c exit3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\.c9470058cca0e1cb82d4c0a07fecd0db.glmfxuwrzfiilfucejqfnaqhhspoific.__selfdelete__.exeFilesize
714KB
MD5c9470058cca0e1cb82d4c0a07fecd0db
SHA1a66d76d86448965e57d7be96a57529c497e4b99d
SHA256fe2982abd3fbb02808da5892a6a262bccdd0b8650c79fb2d6e2f1fd401297da5
SHA512ec8cc6b45e2703ee8c227a0fe7d3e1efb999ae0de583cc98e7ef7aa932f686fc06bea21081be19a2cc11e784ab7161129ecd7288bae971b4fce7fba44296388a