Analysis

  • max time kernel
    120s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    06-03-2024 17:21

General

  • Target

    084f9ba4c047668690fdcaf1d9518d77454e8653cb3d6ab5b9407acc5755d945.exe

  • Size

    819KB

  • MD5

    5a8e1724bea3fbc05af3d5b3619f527e

  • SHA1

    b702dea37a8f977e2d946c311c89bef59a6e67a6

  • SHA256

    084f9ba4c047668690fdcaf1d9518d77454e8653cb3d6ab5b9407acc5755d945

  • SHA512

    c6820a4a32a5689fc769865d0deb3cba2d358f13a543b0d29fe0d31db563a7aa84f8afde7b6d419cf1e699b5ee2044bea89312baa169583c8dbec8bd26fbc158

  • SSDEEP

    24576:Kui4rB93oPp+E8YvaKR97cmYvaKRqCr9HldAHJ:xPn3oPp+E8Yv53cmYv5nrdAH

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\084f9ba4c047668690fdcaf1d9518d77454e8653cb3d6ab5b9407acc5755d945.exe
    "C:\Users\Admin\AppData\Local\Temp\084f9ba4c047668690fdcaf1d9518d77454e8653cb3d6ab5b9407acc5755d945.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2492
    • C:\Users\Admin\AppData\Local\Temp\533E.tmp
      "C:\Users\Admin\AppData\Local\Temp\533E.tmp" --pingC:\Users\Admin\AppData\Local\Temp\084f9ba4c047668690fdcaf1d9518d77454e8653cb3d6ab5b9407acc5755d945.exe D0B9B1A34C309715E2045B107178CB97CFB63F210826015F6D0F069BF8793EB6615AA32E07F60D595487A9807CF43FBEA7DC6DEDCB448BF6457BFA62C5C7BA22
      2⤵
      • Deletes itself
      • Executes dropped EXE
      PID:1444

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\533E.tmp

    Filesize

    819KB

    MD5

    299f6e569e2777fbc3e8df95776c742c

    SHA1

    91611476a6922d8b09786a655099562e029cec50

    SHA256

    16027b7a542aaf6adbfa237e73a662c0589c369bf125fc0638f07800ab3284b9

    SHA512

    154d4fcdd21b73ff823bda1b857feed3567ee8665ce2f722505bd8c4c179e5a54314d5e783169a77c065e7ad21354a95351050bcafee56d39e88669a42a2fde6