Analysis
-
max time kernel
143s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
12/02/2024, 20:57
General
-
Target
9795ec5ad4b08b431fc73808c28eec07.exe
-
Size
385KB
-
MD5
9795ec5ad4b08b431fc73808c28eec07
-
SHA1
a2f8a3a0df431b413ebf538ff9c0bbd21937190d
-
SHA256
34a8ee6eba0da182a7e88746842ea699040e856a52a3eca62b8fbafbd9886fb0
-
SHA512
e6e3f6f71bccb40ee037c6a21bd412c4351049d699f9f8c2dc9ff4b693a661a0b4ca370eb4e2b01d13d0a6da0de102b10935fa8c2a65d612371020d417ec061f
-
SSDEEP
12288:/OxpqAqK2OfNWM7uisFDzf56fQEZdze8B:G0AHDsMOF8f/ze8B
Score
7/10
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\9795ec5ad4b08b431fc73808c28eec07.exe"C:\Users\Admin\AppData\Local\Temp\9795ec5ad4b08b431fc73808c28eec07.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\9795ec5ad4b08b431fc73808c28eec07.exeC:\Users\Admin\AppData\Local\Temp\9795ec5ad4b08b431fc73808c28eec07.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
385KB
MD5795e2cbc0f8934aa978d7f598d4ee847
SHA12a90916752bc63f73e061cc6d9c00e7a504de081
SHA256ecf2e0760e3e5228d938caf619a392740463e772a29db9777318eb53d10348e1
SHA5126bff82074ae53625a684c27abd7bb823185114c614bb7a73580d6edfdf9030f504e9e5d727e44a4426e0a5e8643450f5c7606b0faeac47d5e7255024451eb97e
-
Filesize
408KB
-
Filesize
408KB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
408KB
-
Filesize
408KB
-
Filesize
380KB
-
Filesize
240KB
-
Filesize
56KB
-
Filesize
240KB
-
Filesize
56KB