Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
-
submitted
01-02-2024 05:52
General
-
Target
861a4ba24005a1f99c85b8ca51d3f8c9.exe
-
Size
1.9MB
-
MD5
861a4ba24005a1f99c85b8ca51d3f8c9
-
SHA1
df04f796e7e45a3b57b59c4dd73b8a28fc2b3539
-
SHA256
7ea7ae717196d60d0334b6fc515daf9d7796cb490d32ab63ee47fa9f902da7ab
-
SHA512
4f7f94eff4886433402847b43ac07075d21eab24b7343b2da8eae0c89d7973bbbc4177d4aad434273790051705d1390163b8299419fd963917264b73f8a410c1
-
SSDEEP
49152:Qoa1taC070dodJvSqrpE9cd8iSmr2FW1H0n5:Qoa1taC0ldpu9cSi+F04
Score
7/10
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\861a4ba24005a1f99c85b8ca51d3f8c9.exe"C:\Users\Admin\AppData\Local\Temp\861a4ba24005a1f99c85b8ca51d3f8c9.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\DD6.tmp"C:\Users\Admin\AppData\Local\Temp\DD6.tmp" --splashC:\Users\Admin\AppData\Local\Temp\861a4ba24005a1f99c85b8ca51d3f8c9.exe AA5E108BBEF1DDF4727732D0D64B809E38F4975FC883AF4006D09D87D6DFE610D6889E16C9838F1EAD0226B88B3C247ACAAAD8DE200CF495069A58B1A0A1DC482⤵
- Deletes itself
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.9MB
MD5f0d5d6fde6770eaff069c0b495f180d6
SHA1f8d1df7e367d3914828a0643579cf469d3aa6fea
SHA256d279404d1cb09e211f661fccc8264016d975485e85685078b3c144be3dfbe862
SHA51209486847c59529b74046fdba55058e58345fcd4070559c94b86b0e45fb2c06dbc4e40506fc1bdfca019a70543ce80d8740f4133a0a084e784a8b0837ac2df626
-
Filesize
1.9MB
-
Filesize
1.9MB