Analysis
-
max time kernel
141s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
12/02/2024, 02:55
General
-
Target
1561edfef7a4549466f790bc4cf86c1ff1cb74604621e63388674ab1ed94e09a.exe
-
Size
23.6MB
-
MD5
676c5efe2dd5efd736d177950899013c
-
SHA1
c7e29bc0f7a209bdadf96911e88a31e05e6f3280
-
SHA256
1561edfef7a4549466f790bc4cf86c1ff1cb74604621e63388674ab1ed94e09a
-
SHA512
94a73545692eee7fba9d1177ec4a6eae6a8fa9670d461ed99c965eaa8a81ce9538a29cfc56bf4575eee00831e47661e777de92897ec815fb7f7cee8213b9dff1
-
SSDEEP
393216:xbbmHFpFgyHkLQFWaTj5++V3RWSbK2UDAV7QedEoe/LzO/qfo/GwgwaenAgw3of:xuHFpf5FUw3RWr2UUIX/LCywuwseANG
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1561edfef7a4549466f790bc4cf86c1ff1cb74604621e63388674ab1ed94e09a.exe"C:\Users\Admin\AppData\Local\Temp\1561edfef7a4549466f790bc4cf86c1ff1cb74604621e63388674ab1ed94e09a.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-IJTD8.tmp\1561edfef7a4549466f790bc4cf86c1ff1cb74604621e63388674ab1ed94e09a.tmp"C:\Users\Admin\AppData\Local\Temp\is-IJTD8.tmp\1561edfef7a4549466f790bc4cf86c1ff1cb74604621e63388674ab1ed94e09a.tmp" /SL5="$400EC,23761289,788480,C:\Users\Admin\AppData\Local\Temp\1561edfef7a4549466f790bc4cf86c1ff1cb74604621e63388674ab1ed94e09a.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
527KB
MD5d32b80f239c3626519c9987291011bb1
SHA1bbd4ef37e5c45706236416fde09a19d92dd49ac4
SHA256e879157e9823a32899dda0fc594951d71d1e9ac4bdafb6ad1d38eec2580f2de9
SHA512a86b668e44b96f48070de63ca401b3f42afb13db4cc7cb87553e7d57cb8ea75f5d1a470e6a0311db9bfe7df39424b36ad4d2f1e9bbe08a888853a6f8fdc4a7fa
-
Filesize
896KB
MD5d6319643e7f8e8e9f799077f58c86ca5
SHA1ee7bbe9bc0f2c795529093512b0de46245a629e6
SHA2569ca230864e9674238a04cb24ed7fb0ef0eafc1b94915dcfe36c081d87007f09b
SHA51278b675ee466c57c3e6462e976a78811795618b803dfcac22949cbc84d561f18fde274c5c1d7371f47e9ab84b1bddb8dcd0d6468075812c924d0cccffab752a39
-
Filesize
824KB
-
Filesize
824KB
-
Filesize
4KB
-
Filesize
2.9MB
-
Filesize
4KB