Analysis
-
max time kernel
145s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
25-01-2024 16:00
Static task
static1
Behavioral task
behavioral1
Sample
74eb2f2296203d16e8c89bcb8c851af1.exe
Resource
win7-20231215-en
General
-
Target
74eb2f2296203d16e8c89bcb8c851af1.exe
-
Size
1.9MB
-
MD5
74eb2f2296203d16e8c89bcb8c851af1
-
SHA1
4928221fab39131cafd862f8887a9a603c970938
-
SHA256
975d5da5cfc98e13ce4ee32e45366f3cb2409add17890a83fc957457e9777509
-
SHA512
9368fda0f64692f639ee121cb8f85b0c17da4b7635bb033c4a24e9504a2ac083a69b1754f08c37471d2c78e8d5dad5b05e6865ac5b3bda1d01b667f5d80d1898
-
SSDEEP
24576:N2oo60HPdt+1CRiY2eOBvcj3u10dmtcixMWZ5MVfIM1q2TF2MlCi5gAJ2ZkfxBDo:Qoa1taC070doM0vM42T10ez72W0l7AE3
Malware Config
Signatures
-
Deletes itself 1 IoCs
Processes:
512D.tmppid process 2172 512D.tmp -
Executes dropped EXE 1 IoCs
Processes:
512D.tmppid process 2172 512D.tmp -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
74eb2f2296203d16e8c89bcb8c851af1.exedescription pid process target process PID 5012 wrote to memory of 2172 5012 74eb2f2296203d16e8c89bcb8c851af1.exe 512D.tmp PID 5012 wrote to memory of 2172 5012 74eb2f2296203d16e8c89bcb8c851af1.exe 512D.tmp PID 5012 wrote to memory of 2172 5012 74eb2f2296203d16e8c89bcb8c851af1.exe 512D.tmp
Processes
-
C:\Users\Admin\AppData\Local\Temp\74eb2f2296203d16e8c89bcb8c851af1.exe"C:\Users\Admin\AppData\Local\Temp\74eb2f2296203d16e8c89bcb8c851af1.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5012 -
C:\Users\Admin\AppData\Local\Temp\512D.tmp"C:\Users\Admin\AppData\Local\Temp\512D.tmp" --splashC:\Users\Admin\AppData\Local\Temp\74eb2f2296203d16e8c89bcb8c851af1.exe DBF00C6B9D81288CA5C569E2B7A0302970BDEBB7C75801AEE77949C200ACF46D3FCFB7FDA4730F0727592C6B2C9EF966E7E1E85FDCC14364050FB291CA1B09252⤵
- Deletes itself
- Executes dropped EXE
PID:2172
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\512D.tmpFilesize
1.9MB
MD56f107397194090593783b1a99e3907ed
SHA15a5e9b2ba3701c4d376b6de3fb5be2eb76e9d683
SHA25689836fb21db3a340c2ddc244bbbaf87e22ea2e8c10fe06706e6e8562955637fd
SHA512c330e14635394550b46555ef5b093f3959545bc475294c4633312e0d95d938d3a96b3f8754eff1d1b174f0b22abb0f0dda9537a7392ece268483b029a768e526
-
memory/2172-5-0x0000000000400000-0x00000000005E6000-memory.dmpFilesize
1.9MB
-
memory/5012-0-0x0000000000400000-0x00000000005E6000-memory.dmpFilesize
1.9MB