Overview

overview

7

Static

static

3

8a1513f608...32.exe

windows7-x64

7

8a1513f608...32.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    120s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    02/02/2024, 17:16

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    8a1513f608c053c48b7fe97512dcba32.exe

  • Size

    1.9MB

  • MD5

    8a1513f608c053c48b7fe97512dcba32

  • SHA1

    5f5c679d63b66b93a70214f9f6d98da4b5aae2de

  • SHA256

    3bf986cfb4b6f60ff74394b72a6e3fe64deb7300eb560d0efeba1fbb614161c7

  • SHA512

    d19a61431c0cf064874457d21efe42950fba42979922f3058540e972708fc3c2afffdc16524dc8d16cd5b2940ec166f4e232e7d680c2d14f47323f22dffc9d21

  • SSDEEP

    49152:Qoa1taC070dP85bW+O28M3LR8b4bjw9JkjDiguQdrn:Qoa1taC0FbOEOG8/kjDig3drn

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8a1513f608c053c48b7fe97512dcba32.exe
    "C:\Users\Admin\AppData\Local\Temp\8a1513f608c053c48b7fe97512dcba32.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:808
    • C:\Users\Admin\AppData\Local\Temp\5503.tmp
      "C:\Users\Admin\AppData\Local\Temp\5503.tmp" --splashC:\Users\Admin\AppData\Local\Temp\8a1513f608c053c48b7fe97512dcba32.exe 39307A00785958C676BBBC96A122E0B208F862D2D672395F36805840C9F0F1F0062E1D2DE6D74111397E3BE6F949620977FE0A260E0983C0ED0A21605A692B4F
      2⤵
      • Deletes itself
      • Executes dropped EXE
      PID:3052

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • \Users\Admin\AppData\Local\Temp\5503.tmp
          Filesize

          1.9MB

          MD5

          e33b3e7517fde11c322823b6e3de5c75

          SHA1

          23be680950984bd8ce6fca2e397c38472541e0f6

          SHA256

          6db3dbdfb9d8e99b32190aa983161643d530d2dfce9c0bccff6c74f75c91047d

          SHA512

          44a38f32a68d99c5dc6464e5cf437d86181bb8509c9a1a3e52ef1e7c702222d36559def8e7d93603d0aadc808cc5f52686829180fecdbd3d02b835a40b0ad0a1

          Download Submit

        • memory/808-0-0x0000000000400000-0x00000000005E6000-memory.dmp

          Filesize

          1.9MB

          Download

        • memory/3052-6-0x0000000000400000-0x00000000005E6000-memory.dmp

          Filesize

          1.9MB

          Download