Resubmissions

25-01-2024 18:00

240125-wls3escce7 7

25-01-2024 17:54

240125-wg9vdacbe2 10

Analysis

  • max time kernel
    118s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    25-01-2024 18:00

General

  • Target

    75252ed3edcacd50236c6d9e961f898f.exe

  • Size

    1.9MB

  • MD5

    75252ed3edcacd50236c6d9e961f898f

  • SHA1

    efef972a8f54fa5d42ca2d622fb94f4d8747af34

  • SHA256

    54fff92b7ec716bea89b872bb2eca31d8367cd50786bcada4b4464f9dfcb4e0b

  • SHA512

    f03eae8e273f4775482e1949e51f5a231e3b63a9e09a6945a0467210990f89d517375808b4dcbfa4ceac450294de054a780aef04f7de5d88743caa2895fa770b

  • SSDEEP

    24576:N2oo60HPdt+1CRiY2eOBvcj3u10dwZK/QO1TUUZx9BulEO9RK0u+39IQoOLyUFF/:Qoa1taC070d/QAUYMlp9RKc3WQoOLvF/

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\75252ed3edcacd50236c6d9e961f898f.exe
    "C:\Users\Admin\AppData\Local\Temp\75252ed3edcacd50236c6d9e961f898f.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2264
    • C:\Users\Admin\AppData\Local\Temp\25E8.tmp
      "C:\Users\Admin\AppData\Local\Temp\25E8.tmp" --splashC:\Users\Admin\AppData\Local\Temp\75252ed3edcacd50236c6d9e961f898f.exe 24BC71F48AFAD663FC456BC6A602926E54BBBA903B9D4E3A4534A156BF9FDAA0E704EDF0D6C4EF37877F1246A085031FBB78E40610E4591425A625FDC3D8F083
      2⤵
      • Deletes itself
      • Executes dropped EXE
      PID:2860

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\25E8.tmp

    Filesize

    1.2MB

    MD5

    d56ac5faa82e1cdac61716d18d49764e

    SHA1

    48da63a954cae3c95f1daab1fb21f67eb145a349

    SHA256

    4c3a93a26b3e185146170886ab278338131f33aa06e7c4c6574ddf9e5905d09b

    SHA512

    4d05d9bf52e868d9d01d8e39916dd8298e4e42a6c20636b4ba02820b28f22d0bcd2a4d24d1a37c44ffe63ea0c4f68bbda5124ac0fc2aac755a00f81f3eedb855

  • \Users\Admin\AppData\Local\Temp\25E8.tmp

    Filesize

    1.3MB

    MD5

    63f5393b7d5cc2816cca0941f42dc0fd

    SHA1

    b255bb0a54bdb2af7a085add6d4184bbe30b9c9c

    SHA256

    40f507935ce9828b6da14758f3f20e74f65d3eb054d6e2e285f8f22344f28702

    SHA512

    f7f0d19f6084b8da5ddf17e933a74ba7c0822165cb6bab2937cda9124e956df64e16b6f5e9884213eba6512066bd465a5a17726b327f21abf63e82bf1edaf770

  • memory/2264-0-0x0000000000400000-0x00000000005E6000-memory.dmp

    Filesize

    1.9MB

  • memory/2860-6-0x0000000000400000-0x00000000005E6000-memory.dmp

    Filesize

    1.9MB