Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
25-01-2024 18:00
Static task
static1
Behavioral task
behavioral1
Sample
75252ed3edcacd50236c6d9e961f898f.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
75252ed3edcacd50236c6d9e961f898f.exe
Resource
win10v2004-20231215-en
General
-
Target
75252ed3edcacd50236c6d9e961f898f.exe
-
Size
1.9MB
-
MD5
75252ed3edcacd50236c6d9e961f898f
-
SHA1
efef972a8f54fa5d42ca2d622fb94f4d8747af34
-
SHA256
54fff92b7ec716bea89b872bb2eca31d8367cd50786bcada4b4464f9dfcb4e0b
-
SHA512
f03eae8e273f4775482e1949e51f5a231e3b63a9e09a6945a0467210990f89d517375808b4dcbfa4ceac450294de054a780aef04f7de5d88743caa2895fa770b
-
SSDEEP
24576:N2oo60HPdt+1CRiY2eOBvcj3u10dwZK/QO1TUUZx9BulEO9RK0u+39IQoOLyUFF/:Qoa1taC070d/QAUYMlp9RKc3WQoOLvF/
Malware Config
Signatures
-
Deletes itself 1 IoCs
Processes:
25E8.tmppid process 2860 25E8.tmp -
Executes dropped EXE 1 IoCs
Processes:
25E8.tmppid process 2860 25E8.tmp -
Loads dropped DLL 1 IoCs
Processes:
75252ed3edcacd50236c6d9e961f898f.exepid process 2264 75252ed3edcacd50236c6d9e961f898f.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
75252ed3edcacd50236c6d9e961f898f.exedescription pid process target process PID 2264 wrote to memory of 2860 2264 75252ed3edcacd50236c6d9e961f898f.exe 25E8.tmp PID 2264 wrote to memory of 2860 2264 75252ed3edcacd50236c6d9e961f898f.exe 25E8.tmp PID 2264 wrote to memory of 2860 2264 75252ed3edcacd50236c6d9e961f898f.exe 25E8.tmp PID 2264 wrote to memory of 2860 2264 75252ed3edcacd50236c6d9e961f898f.exe 25E8.tmp
Processes
-
C:\Users\Admin\AppData\Local\Temp\75252ed3edcacd50236c6d9e961f898f.exe"C:\Users\Admin\AppData\Local\Temp\75252ed3edcacd50236c6d9e961f898f.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2264 -
C:\Users\Admin\AppData\Local\Temp\25E8.tmp"C:\Users\Admin\AppData\Local\Temp\25E8.tmp" --splashC:\Users\Admin\AppData\Local\Temp\75252ed3edcacd50236c6d9e961f898f.exe 24BC71F48AFAD663FC456BC6A602926E54BBBA903B9D4E3A4534A156BF9FDAA0E704EDF0D6C4EF37877F1246A085031FBB78E40610E4591425A625FDC3D8F0832⤵
- Deletes itself
- Executes dropped EXE
PID:2860
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD5d56ac5faa82e1cdac61716d18d49764e
SHA148da63a954cae3c95f1daab1fb21f67eb145a349
SHA2564c3a93a26b3e185146170886ab278338131f33aa06e7c4c6574ddf9e5905d09b
SHA5124d05d9bf52e868d9d01d8e39916dd8298e4e42a6c20636b4ba02820b28f22d0bcd2a4d24d1a37c44ffe63ea0c4f68bbda5124ac0fc2aac755a00f81f3eedb855
-
Filesize
1.3MB
MD563f5393b7d5cc2816cca0941f42dc0fd
SHA1b255bb0a54bdb2af7a085add6d4184bbe30b9c9c
SHA25640f507935ce9828b6da14758f3f20e74f65d3eb054d6e2e285f8f22344f28702
SHA512f7f0d19f6084b8da5ddf17e933a74ba7c0822165cb6bab2937cda9124e956df64e16b6f5e9884213eba6512066bd465a5a17726b327f21abf63e82bf1edaf770