Analysis
-
max time kernel
142s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
12-02-2024 03:08
General
-
Target
961633b69e93de143896d782595afab6.exe
-
Size
907KB
-
MD5
961633b69e93de143896d782595afab6
-
SHA1
d395ab16bf78062cc33ce51136dad51a62c865e9
-
SHA256
804135bba7311e0eee67dec9a6908c3b0943fde9800266b0ec26864d261751bf
-
SHA512
2eef625dc03c9d7219e8d826b673dc47668641412786047a00782fab389ce6b35c217735ae55b189d08ff4347835ce7cf2754108971c1e97c0073d9c0ff46e38
-
SSDEEP
12288:eMv1aLsg4AI7ZknIHG9sxc4Ay8euoKRQMcla1o1V+5dyjOrtO1ZiushjVDa/ZS1:eMksJb9JGYc4Ay8HLerrVY8eusXa/ZS1
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\961633b69e93de143896d782595afab6.exe"C:\Users\Admin\AppData\Local\Temp\961633b69e93de143896d782595afab6.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\961633b69e93de143896d782595afab6.exeC:\Users\Admin\AppData\Local\Temp\961633b69e93de143896d782595afab6.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
907KB
MD51dc91cefc5bbb0a2d61dcfb357b35e5b
SHA12000f3aba531de2667ed6c06a77711670082b048
SHA256183575a886417650843b1fdbb9d5ac8e28cf990fa8854104a0d85257313ed291
SHA512a51fdbb81d40037d9c40a454132836b51b15611644d8b54326b3a280697e22e928c41d46ba1efee626d72a4b1a1380ab3dc2fd3b9d9c15ff5c069c0af67bdc46
-
Filesize
928KB
-
Filesize
928KB
-
Filesize
748KB
-
Filesize
748KB
-
Filesize
928KB
-
Filesize
928KB
-
Filesize
748KB
-
Filesize
608KB
-
Filesize
268KB
-
Filesize
608KB