Analysis
-
max time kernel
89s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
-
submitted
14-02-2024 09:49
General
-
Target
9b5bea6e1ff86696a15434a4fc2698c9.exe
-
Size
385KB
-
MD5
9b5bea6e1ff86696a15434a4fc2698c9
-
SHA1
214fe8def46d3dbfa085c415ccfc027919cd6c3c
-
SHA256
6000d15283ee8d91f39cc58ed9a8dac8669915778575af8eda4cbc414e554bfd
-
SHA512
cfeef1d544b36063d9d7344578804d307f23c171ac7f8c2b329c925404439cb1e848d362d27c205083a99e762cbe89821d96013b8847110ad5272c0525c600e9
-
SSDEEP
12288:rdZJOrEF/jtCe9KUq9DiufomBvpR0A81VypXlAfU9UCt1ON/B:fJOYVke0UGDfomZpR0T1OXlAfU9UCt12
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\9b5bea6e1ff86696a15434a4fc2698c9.exe"C:\Users\Admin\AppData\Local\Temp\9b5bea6e1ff86696a15434a4fc2698c9.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\9b5bea6e1ff86696a15434a4fc2698c9.exeC:\Users\Admin\AppData\Local\Temp\9b5bea6e1ff86696a15434a4fc2698c9.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
385KB
MD5b89416c6c78ce31d31f585daddd30645
SHA1784c9216a7b746b1756c856a48af7be9ae2b10fa
SHA2568174042d3a3b11992ae6a0d27ed32af575fa8c432c07d4b46c94a735b5629354
SHA512223836147969e0e3b6b055ef7764c07c408a9427f3017f88c21e7e13fecb4288152d6bee5cbb0cd0185000727f3dce361730b4311840d790d72a281bb099b2fe
-
Filesize
408KB
-
Filesize
408KB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
408KB
-
Filesize
408KB
-
Filesize
240KB
-
Filesize
380KB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
240KB