Analysis
-
max time kernel
117s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
27-02-2024 15:19
Behavioral task
behavioral1
Sample
a97c1a835321795116cb3aeabf5113c2.exe
Resource
win7-20240221-en
General
-
Target
a97c1a835321795116cb3aeabf5113c2.exe
-
Size
1.3MB
-
MD5
a97c1a835321795116cb3aeabf5113c2
-
SHA1
1f1f9ee69ebabd91cfefe717e6e919bbdada4cf2
-
SHA256
e1f78084344a8b3118e8de8be1a92f2be364cab663e65a706133f16f27148429
-
SHA512
8f1518a5bdf072495eb23a36d5ef7c95ad6fbf6fec96bb27d2316b4c1b81bfca4aacd7f6634339c9250e2ee5f40167040e6cf8b6cba3714e20506e7748fdbe0d
-
SSDEEP
24576:ji3fRi8qDfO91LCS69E5DNNl+hJI7jDWFlqJLYQ0+VOV7vG:jMN91ZL5hv+qSvqJHd
Malware Config
Signatures
-
Deletes itself 1 IoCs
Processes:
a97c1a835321795116cb3aeabf5113c2.exepid process 2384 a97c1a835321795116cb3aeabf5113c2.exe -
Executes dropped EXE 1 IoCs
Processes:
a97c1a835321795116cb3aeabf5113c2.exepid process 2384 a97c1a835321795116cb3aeabf5113c2.exe -
Loads dropped DLL 1 IoCs
Processes:
a97c1a835321795116cb3aeabf5113c2.exepid process 2068 a97c1a835321795116cb3aeabf5113c2.exe -
Processes:
resource yara_rule behavioral1/memory/2068-0-0x0000000000400000-0x000000000086A000-memory.dmp upx \Users\Admin\AppData\Local\Temp\a97c1a835321795116cb3aeabf5113c2.exe upx behavioral1/memory/2068-15-0x0000000003420000-0x000000000388A000-memory.dmp upx -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
a97c1a835321795116cb3aeabf5113c2.exepid process 2068 a97c1a835321795116cb3aeabf5113c2.exe -
Suspicious use of UnmapMainImage 2 IoCs
Processes:
a97c1a835321795116cb3aeabf5113c2.exea97c1a835321795116cb3aeabf5113c2.exepid process 2068 a97c1a835321795116cb3aeabf5113c2.exe 2384 a97c1a835321795116cb3aeabf5113c2.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
a97c1a835321795116cb3aeabf5113c2.exedescription pid process target process PID 2068 wrote to memory of 2384 2068 a97c1a835321795116cb3aeabf5113c2.exe a97c1a835321795116cb3aeabf5113c2.exe PID 2068 wrote to memory of 2384 2068 a97c1a835321795116cb3aeabf5113c2.exe a97c1a835321795116cb3aeabf5113c2.exe PID 2068 wrote to memory of 2384 2068 a97c1a835321795116cb3aeabf5113c2.exe a97c1a835321795116cb3aeabf5113c2.exe PID 2068 wrote to memory of 2384 2068 a97c1a835321795116cb3aeabf5113c2.exe a97c1a835321795116cb3aeabf5113c2.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a97c1a835321795116cb3aeabf5113c2.exe"C:\Users\Admin\AppData\Local\Temp\a97c1a835321795116cb3aeabf5113c2.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\a97c1a835321795116cb3aeabf5113c2.exeC:\Users\Admin\AppData\Local\Temp\a97c1a835321795116cb3aeabf5113c2.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\a97c1a835321795116cb3aeabf5113c2.exeFilesize
1.3MB
MD59bc268ac1687da01e925b53042defbe8
SHA1ce12dd92b96451b4f1aaa753845e3af76364d264
SHA256cff2a849077d0706a2b82efeacd990eced08e52a4473b721f82de399988a6737
SHA5126563d07b70aa16ece614998db636fda0d901965909b37d11611ac665151a128f1b97ebb423904d5a57476a064001c1deeb53451a9288baec7837223124f13390
-
memory/2068-0-0x0000000000400000-0x000000000086A000-memory.dmpFilesize
4.4MB
-
memory/2068-1-0x0000000000400000-0x00000000005F2000-memory.dmpFilesize
1.9MB
-
memory/2068-2-0x0000000000130000-0x0000000000242000-memory.dmpFilesize
1.1MB
-
memory/2068-15-0x0000000003420000-0x000000000388A000-memory.dmpFilesize
4.4MB
-
memory/2068-14-0x0000000000400000-0x00000000005F2000-memory.dmpFilesize
1.9MB
-
memory/2068-26-0x0000000003420000-0x000000000388A000-memory.dmpFilesize
4.4MB
-
memory/2384-17-0x0000000000400000-0x00000000005F2000-memory.dmpFilesize
1.9MB
-
memory/2384-19-0x0000000000400000-0x000000000086A000-memory.dmpFilesize
4.4MB
-
memory/2384-21-0x0000000001A60000-0x0000000001B72000-memory.dmpFilesize
1.1MB
-
memory/2384-27-0x0000000000400000-0x000000000086A000-memory.dmpFilesize
4.4MB