Analysis
-
max time kernel
87s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
-
submitted
13-02-2024 03:00
General
-
Target
984ea6d2695aded9da5e951dbcc82682.exe
-
Size
385KB
-
MD5
984ea6d2695aded9da5e951dbcc82682
-
SHA1
119fd8405fb363754fb2fcf7065d62e5dd89e65f
-
SHA256
fcdc68958dfcb197438c48a0d6b85f48ad87bb6721ccbfc8ddbf1ca752fc2655
-
SHA512
3a0c0cd7f63b8230823365823711c68d4da0d895b1252b6f2d7558a6a590a53d881a96a56a44e6fcd61b95b4737d1718d5bf1384b46cac12fef2c7d04298b0bc
-
SSDEEP
12288:TReICoFPdad3ov68uMtYp7XI2aHibuknODsB:3pMdYMlXIZOdB
Score
7/10
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\984ea6d2695aded9da5e951dbcc82682.exe"C:\Users\Admin\AppData\Local\Temp\984ea6d2695aded9da5e951dbcc82682.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\984ea6d2695aded9da5e951dbcc82682.exeC:\Users\Admin\AppData\Local\Temp\984ea6d2695aded9da5e951dbcc82682.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
385KB
MD524e9bd3d7b3f88fec2314c98258742ee
SHA1da0a78e7e32a77c4ea7ec80aeb8aee828fe82922
SHA2565cf9efaa90642a9e6ae39968dad8a82bada81574f9dc020ffacf4c62cf20ba01
SHA5124de81135fc980a1137f9ca6ce1a2e291662564be16b86df2c173f3e46d4890981138dd83948ae9f17378ed174e9f9bb4848b9bb35dc3320981c82eedcf2ee158
-
Filesize
408KB
-
Filesize
408KB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
408KB
-
Filesize
408KB
-
Filesize
240KB
-
Filesize
380KB
-
Filesize
240KB
-
Filesize
56KB
-
Filesize
56KB