Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
-
submitted
06/03/2024, 09:01
General
-
Target
b70930543bf11405346954b8e712dcaa.exe
-
Size
82KB
-
MD5
b70930543bf11405346954b8e712dcaa
-
SHA1
2ab315a2d21f377392cf8d9a6d0f91a4064aa846
-
SHA256
a54fc2530240b2142a7e2e0ce67da961869f1d4d32950c4b950457f54baa63ae
-
SHA512
87bf7d53d1004526564e2bc1dddc3c4ea75add72f4f49ed45d26fef679d6f470f12409b2678403b962f3cb8bcc1e20ae600b3801552decef50a0e79cb5b4e124
-
SSDEEP
1536:oYulJijAFuLVj/K+Lh3LAzBdWbA25ARYMD+B8NolEmIVB7N/YCiQLsge3FEc4:B/AFuxzhlQBQjCCBn2T7NwCC9Sc4
Score
7/10
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b70930543bf11405346954b8e712dcaa.exe"C:\Users\Admin\AppData\Local\Temp\b70930543bf11405346954b8e712dcaa.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\b70930543bf11405346954b8e712dcaa.exeC:\Users\Admin\AppData\Local\Temp\b70930543bf11405346954b8e712dcaa.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
82KB
MD540e3dd6c795aded1ab18b61a01ee5146
SHA1d5880181f1808bda5af864caee9401fc4a4e73fc
SHA2567822f281f4f99e58b0321ac05b3647640bbd10ad80f3e00c3325d03fff96ecbd
SHA512eb9df2a738dac31ec1e9d58172bc0dd6b0d6b389e0b875c421e0ff42cab4a159cc6c56bef3c9748438a0a6b29a69b0a6c31e70509e6b46b3241a10c966c3b30c
-
Filesize
188KB
-
Filesize
108KB
-
Filesize
188KB
-
Filesize
108KB
-
Filesize
188KB
-
Filesize
188KB
-
Filesize
56KB
-
Filesize
108KB