Analysis

  • max time kernel
    96s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08/03/2024, 21:34

General

  • Target

    a02408e7fdcfb06e253388d4b2698c200e3a16a8278183dafe47fe638fb787ee.exe

  • Size

    73KB

  • MD5

    c54181aab1a2fe0fc4d1035a81f21597

  • SHA1

    f07695831b6e973359a71d1827e0554590bfc298

  • SHA256

    a02408e7fdcfb06e253388d4b2698c200e3a16a8278183dafe47fe638fb787ee

  • SHA512

    ef7fbafb12e3dce81b76ab53bd80e535bb8ae3bdf0b9087837b2c6705cc888f901ef51adf7dc81e93a6c73905968e0b35e8d4c619aee167e3b85d53643cd7320

  • SSDEEP

    1536:hb/uojkcN6Lb/J5RhwK5QPqfhVWbdsmA+RjPFLC+e5hg0ZGUGf2g:hDuojk7MNPqfcxA+HFshgOg

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a02408e7fdcfb06e253388d4b2698c200e3a16a8278183dafe47fe638fb787ee.exe
    "C:\Users\Admin\AppData\Local\Temp\a02408e7fdcfb06e253388d4b2698c200e3a16a8278183dafe47fe638fb787ee.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4160
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c [email protected]
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4856
      • C:\Users\Admin\AppData\Local\Temp\[email protected]
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:2824
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c 15225.exe
          4⤵
            PID:2420

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\[email protected]

      Filesize

      73KB

      MD5

      1102ed868651f3bbc9843a942c68406b

      SHA1

      d8e659f11f681a557ad875e3b845fac7b3d7be3e

      SHA256

      e37a226b665edb953908ccba0248486bcfad3ccb81ea2c5ea0efa27de3cc36ae

      SHA512

      32552f7fe905c5f0c9c2584bdf372566aaa10640cde0f2e67a7887930e4ff8cd0952d5b3e949b6a722bbdbe44e38f9c8fa691f7c272f35a803f1cc7e05ee939c

    • C:\Users\Admin\AppData\Local\Temp\15225.exe

      Filesize

      2KB

      MD5

      7b621943a35e7f39cf89f50cc48d7b94

      SHA1

      2858a28cf60f38025fffcd0ba2ecfec8511c197d

      SHA256

      bef04c2f89dc115ce2763558933dba1767bf30cda6856d335ae68955923f9991

      SHA512

      4169e664ad4e7e6891a05ceed78465e0ec44879b37fc0de97c014945e10c161f6bfb040efc24edc136e69bb115b2a1327b04cefb58141f712da856129872e8f1

    • memory/2824-7-0x0000000000400000-0x0000000000419000-memory.dmp

      Filesize

      100KB

    • memory/4160-8-0x0000000000400000-0x0000000000419000-memory.dmp

      Filesize

      100KB