Analysis

  • max time kernel
    122s
  • max time network
    126s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    03/02/2024, 18:48

General

  • Target

    8d14f2e35c00dffdabe1e8a1d138139f.exe

  • Size

    159KB

  • MD5

    8d14f2e35c00dffdabe1e8a1d138139f

  • SHA1

    92d54039030fcfa92322e7dcacd2244d3675618d

  • SHA256

    4b7e32eefe99af61858f3b802855c913186a8e7590d9727e66389df9b18b1e5a

  • SHA512

    374c17ca47a4d0b7cdc5430c6a5b284cdb6d81c365c2bb7d03f93aa4bb9054cacf894abaeeed11a507a017d934c6cbfa8c650e3cff0e768bc20fa2b070d46ef0

  • SSDEEP

    3072:kwZQ5RyoN1CAErL4X45afqiJOjA35+X/bahwWsrc:kTlXEQX4gsE+XDqdD

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • NTFS ADS 1 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8d14f2e35c00dffdabe1e8a1d138139f.exe
    "C:\Users\Admin\AppData\Local\Temp\8d14f2e35c00dffdabe1e8a1d138139f.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of SetThreadContext
    • NTFS ADS
    • Suspicious use of WriteProcessMemory
    PID:1948
    • C:\Users\Admin\AppData\Local\Temp\8d14f2e35c00dffdabe1e8a1d138139f.exe
      "C:\Users\Admin\AppData\Local\Temp\8d14f2e35c00dffdabe1e8a1d138139f.exe"
      2⤵
        PID:1056

    Network

          MITRE ATT&CK Matrix

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • \Users\Admin\AppData\Local\Temp\eYdW8ae54dqjE6aVew.tmp

            Filesize

            3KB

            MD5

            e2b92a2d8248319df514ebb424bf344f

            SHA1

            747739611d732e72382c9b56e6a83db77b07087d

            SHA256

            00329b987e6741d18f62d8596a5f1222893b5f28b4a0f3190c1a899ef47c8bec

            SHA512

            3d211e9846ff5add6459d515b603d6d5f4a40fdcc73e980161853b9ee9c8dd054dcab709864eac98f440c4dfa085207b829789efac4207c9241788553d6785be

          • memory/1056-4-0x0000000000400000-0x000000000041D000-memory.dmp

            Filesize

            116KB

          • memory/1056-6-0x0000000000400000-0x000000000041D000-memory.dmp

            Filesize

            116KB

          • memory/1056-8-0x0000000000400000-0x000000000041D000-memory.dmp

            Filesize

            116KB

          • memory/1056-10-0x0000000000400000-0x000000000041D000-memory.dmp

            Filesize

            116KB

          • memory/1056-12-0x0000000000400000-0x000000000041D000-memory.dmp

            Filesize

            116KB

          • memory/1056-14-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

            Filesize

            4KB

          • memory/1056-16-0x0000000000400000-0x000000000041D000-memory.dmp

            Filesize

            116KB

          • memory/1056-18-0x0000000000400000-0x000000000041D000-memory.dmp

            Filesize

            116KB

          • memory/1056-19-0x0000000000400000-0x000000000041D000-memory.dmp

            Filesize

            116KB