Analysis
-
max time kernel
142s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
25-01-2024 17:39
Static task
static1
Behavioral task
behavioral1
Sample
751db4c302ac5d5e738b647e9ea3ae98.exe
Resource
win7-20231215-en
General
-
Target
751db4c302ac5d5e738b647e9ea3ae98.exe
-
Size
1.9MB
-
MD5
751db4c302ac5d5e738b647e9ea3ae98
-
SHA1
9c9bfeec8fff6f4ba11039850a05aedd7016eab6
-
SHA256
602b4b65bb376518a94d6d5886463dd6a6fd0c88e2eea948072c7fe75500e73d
-
SHA512
9bc87d4b3834b3c2fde74c52851bef924ba5f5420fa9b686e73a21da0a41c73e0c7d3fe943bc3d5a33b66548d75488831d88e4a45a89648417106cde5a53a88f
-
SSDEEP
49152:Qoa1taC070dPv6ZDqBnw5PFfKiRUfBJgT:Qoa1taC0WB5EUIT
Malware Config
Signatures
-
Deletes itself 1 IoCs
Processes:
851E.tmppid process 1428 851E.tmp -
Executes dropped EXE 1 IoCs
Processes:
851E.tmppid process 1428 851E.tmp -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
751db4c302ac5d5e738b647e9ea3ae98.exedescription pid process target process PID 2252 wrote to memory of 1428 2252 751db4c302ac5d5e738b647e9ea3ae98.exe 851E.tmp PID 2252 wrote to memory of 1428 2252 751db4c302ac5d5e738b647e9ea3ae98.exe 851E.tmp PID 2252 wrote to memory of 1428 2252 751db4c302ac5d5e738b647e9ea3ae98.exe 851E.tmp
Processes
-
C:\Users\Admin\AppData\Local\Temp\751db4c302ac5d5e738b647e9ea3ae98.exe"C:\Users\Admin\AppData\Local\Temp\751db4c302ac5d5e738b647e9ea3ae98.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2252 -
C:\Users\Admin\AppData\Local\Temp\851E.tmp"C:\Users\Admin\AppData\Local\Temp\851E.tmp" --splashC:\Users\Admin\AppData\Local\Temp\751db4c302ac5d5e738b647e9ea3ae98.exe B04E36A440F7F11FC0B1E5D207D79FF516E0C34F8571F865B320F25D2D9BF97733CCC2623FEB4B48D697EB3AF3168DCE965F17D00E80AF3F64A96AFF0F96104D2⤵
- Deletes itself
- Executes dropped EXE
PID:1428
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\851E.tmpFilesize
1.9MB
MD5d18c34c47bbf269424ef741b3f304a0b
SHA1e56788174d4142dc3d02cbc86c7887fa22f4b906
SHA256ea32b3d6594340e7db542e2541a2b345a9bf563413dc6cfb3bd830700a8e0d1e
SHA5122d7658e7927096056ebc19f06638d04d1b1b5b86c17d65688cadc2142507e9f23aef3b511b19e98f6b7bdcd1e1a626b4c64c52db3cb7d00034faa2a72c164265
-
memory/1428-5-0x0000000000400000-0x00000000005E6000-memory.dmpFilesize
1.9MB
-
memory/2252-0-0x0000000000400000-0x00000000005E6000-memory.dmpFilesize
1.9MB