442173a2d58595d04ffdac75b5643f71a7037541355806a5062866c12ae1a8e3

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
29-01-2024 04:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7edfd2168d4fd92077ea207ba1460e54.exe
Size

1.6MB
MD5

7edfd2168d4fd92077ea207ba1460e54
SHA1

64bfdbed5743c13e05d44680101e340a4e406f1c
SHA256

442173a2d58595d04ffdac75b5643f71a7037541355806a5062866c12ae1a8e3
SHA512

0803c11c3e958e30e56139362f241c1aeef3d00abd1643d5206bc51b3955f084177f8e07e633f580e83299f494f4dfdd46444bd9c1cd095ccd60b08621970ac0
SSDEEP

49152:bLNuLGqyL1+3I5AbFRJMGd1zatc8V16/226tMc:HkGTL1SQSGGd1z4c8L6/22O

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2212	7edfd2168d4fd92077ea207ba1460e54.exe

Executes dropped EXE 1 IoCs

pid	Process
2212	7edfd2168d4fd92077ea207ba1460e54.exe

Loads dropped DLL 1 IoCs

pid	Process
2248	7edfd2168d4fd92077ea207ba1460e54.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2248	7edfd2168d4fd92077ea207ba1460e54.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2248	7edfd2168d4fd92077ea207ba1460e54.exe
2212	7edfd2168d4fd92077ea207ba1460e54.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2248 wrote to memory of 2212	2248	7edfd2168d4fd92077ea207ba1460e54.exe	28
PID 2248 wrote to memory of 2212	2248	7edfd2168d4fd92077ea207ba1460e54.exe	28
PID 2248 wrote to memory of 2212	2248	7edfd2168d4fd92077ea207ba1460e54.exe	28
PID 2248 wrote to memory of 2212	2248	7edfd2168d4fd92077ea207ba1460e54.exe	28

C:\Users\Admin\AppData\Local\Temp\7edfd2168d4fd92077ea207ba1460e54.exe
"C:\Users\Admin\AppData\Local\Temp\7edfd2168d4fd92077ea207ba1460e54.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2248
- C:\Users\Admin\AppData\Local\Temp\7edfd2168d4fd92077ea207ba1460e54.exe
  C:\Users\Admin\AppData\Local\Temp\7edfd2168d4fd92077ea207ba1460e54.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:2212

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7edfd2168d4fd92077ea207ba1460e54.exe

Filesize
1.1MB

MD5
4e43d44655b2587c7ebf30b8eece7495

SHA1
b427866914872349c0a6a5c719854dacecad3b62

SHA256
9245f679313fa61ae8c8526afc9eba9cf7a5e1cf79bea07bc2c0a0ca40d8d13a

SHA512
9d75206146829ec55813f8338a1b38c1d15dbc44eebab8a3302adc8d8ec0876c5aa668f981a7a45a5118d68924ce81842e510842417e8ab6e11b9f69b0da3385

Download Submit
\Users\Admin\AppData\Local\Temp\7edfd2168d4fd92077ea207ba1460e54.exe

Filesize
1.0MB

MD5
1e2695f6c3f89e4a212368651f5b6c1a

SHA1
cc7e5147c4545c7a8f70ebb7e8c1e2ebeef99c85

SHA256
6c45ea149136accc581224a21c8076ec8e6c7ffc6f1318c3ee1af3e3516ccdb1

SHA512
8f660956297d066dca0ec798e39ca3468ea2294e0b65d98c7a6d9e250e79d3222a44e5dbbf369eeb2efa18e50775a539a945ff04de08e802980ea27b564251f2

Download Submit
memory/2212-17-0x0000000000400000-0x0000000000877000-memory.dmp

Filesize
4.5MB

Download
memory/2212-16-0x0000000000400000-0x000000000064D000-memory.dmp

Filesize
2.3MB

Download
memory/2212-24-0x00000000038B0000-0x0000000003AFD000-memory.dmp

Filesize
2.3MB

Download
memory/2212-22-0x0000000000400000-0x0000000000640000-memory.dmp

Filesize
2.2MB

Download
memory/2248-0-0x0000000000400000-0x0000000000877000-memory.dmp

Filesize
4.5MB

Download
memory/2248-1-0x0000000000400000-0x000000000064D000-memory.dmp

Filesize
2.3MB

Download
memory/2248-2-0x0000000001DC0000-0x0000000002237000-memory.dmp

Filesize
4.5MB

Download
memory/2248-15-0x0000000003B70000-0x0000000003FE7000-memory.dmp

Filesize
4.5MB

Download
memory/2248-13-0x0000000000400000-0x000000000064D000-memory.dmp

Filesize
2.3MB

Download