Analysis
-
max time kernel
122s -
max time network
138s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
05-03-2024 19:57
Static task
static1
Behavioral task
behavioral1
Sample
45c4936b4f881ea0649c208c8800ec200b601e38aa4685a0bef29ebc08fd83ff.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
45c4936b4f881ea0649c208c8800ec200b601e38aa4685a0bef29ebc08fd83ff.exe
Resource
win10v2004-20240226-en
General
-
Target
45c4936b4f881ea0649c208c8800ec200b601e38aa4685a0bef29ebc08fd83ff.exe
-
Size
453KB
-
MD5
62472bcc0ef9887cdcaf9fd433b0b828
-
SHA1
69b74309ffabd4d34e3a7dcf0b1c82b980a84917
-
SHA256
45c4936b4f881ea0649c208c8800ec200b601e38aa4685a0bef29ebc08fd83ff
-
SHA512
71085be98004f2c8f15465b5a8dc47fb7d5259212a5a3e3ea3c7e83ea02df83e78de05a78e8f8e18e437161f5786794cf27b14d0353ca69a0f048a67609c6613
-
SSDEEP
12288:e1mHSMUw836xPUi3gk0npM4dl0v5JHpS0wULW:e1FMUw8iUi3gkEM4dmv5XfW
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2608 45c4936b4f881ea0649c208c8800ec200b601e38aa4685a0bef29ebc08fd83ff.exe -
Executes dropped EXE 1 IoCs
pid Process 2608 45c4936b4f881ea0649c208c8800ec200b601e38aa4685a0bef29ebc08fd83ff.exe -
Loads dropped DLL 1 IoCs
pid Process 1652 45c4936b4f881ea0649c208c8800ec200b601e38aa4685a0bef29ebc08fd83ff.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2608 45c4936b4f881ea0649c208c8800ec200b601e38aa4685a0bef29ebc08fd83ff.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 1652 45c4936b4f881ea0649c208c8800ec200b601e38aa4685a0bef29ebc08fd83ff.exe -
Suspicious use of UnmapMainImage 1 IoCs
pid Process 2608 45c4936b4f881ea0649c208c8800ec200b601e38aa4685a0bef29ebc08fd83ff.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1652 wrote to memory of 2608 1652 45c4936b4f881ea0649c208c8800ec200b601e38aa4685a0bef29ebc08fd83ff.exe 27 PID 1652 wrote to memory of 2608 1652 45c4936b4f881ea0649c208c8800ec200b601e38aa4685a0bef29ebc08fd83ff.exe 27 PID 1652 wrote to memory of 2608 1652 45c4936b4f881ea0649c208c8800ec200b601e38aa4685a0bef29ebc08fd83ff.exe 27 PID 1652 wrote to memory of 2608 1652 45c4936b4f881ea0649c208c8800ec200b601e38aa4685a0bef29ebc08fd83ff.exe 27
Processes
-
C:\Users\Admin\AppData\Local\Temp\45c4936b4f881ea0649c208c8800ec200b601e38aa4685a0bef29ebc08fd83ff.exe"C:\Users\Admin\AppData\Local\Temp\45c4936b4f881ea0649c208c8800ec200b601e38aa4685a0bef29ebc08fd83ff.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1652 -
C:\Users\Admin\AppData\Local\Temp\45c4936b4f881ea0649c208c8800ec200b601e38aa4685a0bef29ebc08fd83ff.exeC:\Users\Admin\AppData\Local\Temp\45c4936b4f881ea0649c208c8800ec200b601e38aa4685a0bef29ebc08fd83ff.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of UnmapMainImage
PID:2608
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\45c4936b4f881ea0649c208c8800ec200b601e38aa4685a0bef29ebc08fd83ff.exe
Filesize453KB
MD5d489d341a61d8089c41d4a20a12aaaf5
SHA197a57d2cfb5507db0f2e89642846e4e27a4c1f0e
SHA256605b3401ae19ffe0f82773b78bbb1ba81df5f4ed6b08ecebe4090c0f968c5dca
SHA51295a79a6065e9880ebac875fd74351d4bc6d45818b2d490c55766b599ec72d71cc2627464022d3d5031b4ee82a0e2732dfe0434e25e15e415d0e42e4f73a78456