Analysis
-
max time kernel
121s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
-
submitted
07/03/2024, 22:14
General
-
Target
b9c9a6d6efececb62b0a52f280cbc4c5.exe
-
Size
82KB
-
MD5
b9c9a6d6efececb62b0a52f280cbc4c5
-
SHA1
4d0e4f02704bf74446efa0aa3788233fba939efe
-
SHA256
f885d747aa922b3f80770b02cbaac944a4fe2abbe228cbfdfd2429a2d26f42b3
-
SHA512
a22f2626a2c1a6c83436323cfbdae70ea8ce8ebd2e6ffcc699c5a674d0d6650d8c7bd5ac12844a04e8beb37b174ba00c95ba1667baa6223f558f9c7f05d179eb
-
SSDEEP
1536:H4COpXqe95iITHNcXzMFtAHj1ZijtxxdxedQjFnY509CHHFtawgYkflD:H4dZi6NlLAHhZiHZ1nk0YHj3Ef9
Score
7/10
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b9c9a6d6efececb62b0a52f280cbc4c5.exe"C:\Users\Admin\AppData\Local\Temp\b9c9a6d6efececb62b0a52f280cbc4c5.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\b9c9a6d6efececb62b0a52f280cbc4c5.exeC:\Users\Admin\AppData\Local\Temp\b9c9a6d6efececb62b0a52f280cbc4c5.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
82KB
MD5853a7f30ba2f71b261816966e53240c2
SHA1d97dbd993bd71ff02a326aa5adebf070ffe0b65d
SHA2569ad9f2f863a237fe8567e002ee1714f79d832906c468eed2c68618edbed2cd70
SHA51253be0762cc41f8c33a12f739c16ff205a44b5a9d7da4f2c439861ffbe618cc05624d4216eeaccfa6fadfb1fc34bb864a79a8a86d1e61aaca417d6a83184083d4
-
Filesize
188KB
-
Filesize
108KB
-
Filesize
188KB
-
Filesize
188KB
-
Filesize
108KB
-
Filesize
56KB
-
Filesize
188KB
-
Filesize
108KB