Analysis
-
max time kernel
141s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
09-03-2024 20:51
General
-
Target
a963d37c3649855102a6328e70acd8e00a983ef127cd8a8ad01d85f837bef267.exe
-
Size
46.1MB
-
MD5
f73c7f375dee046fe26f52cb39214eac
-
SHA1
70216eb745fff95cef74eb9ae2b62572c6aadc3c
-
SHA256
a963d37c3649855102a6328e70acd8e00a983ef127cd8a8ad01d85f837bef267
-
SHA512
58cc2918e143891103c3211aacdc6c0eaf323c66488d6a789a19986a7c99f89be3d84756c72efcc007a1ac64771a10d44fa0c810fdef1778a4851a7f3b6fba08
-
SSDEEP
786432:YpUjx1LGoEbAdS0merPKjhgeRxWs5I0RbPRbeSC4Uu3o7slDfzPIgdjnAdo0/2fx:YpaKoW0CerPcieRPFNBDCN0nQgX0/2fx
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a963d37c3649855102a6328e70acd8e00a983ef127cd8a8ad01d85f837bef267.exe"C:\Users\Admin\AppData\Local\Temp\a963d37c3649855102a6328e70acd8e00a983ef127cd8a8ad01d85f837bef267.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-LLOP9.tmp\a963d37c3649855102a6328e70acd8e00a983ef127cd8a8ad01d85f837bef267.tmp"C:\Users\Admin\AppData\Local\Temp\is-LLOP9.tmp\a963d37c3649855102a6328e70acd8e00a983ef127cd8a8ad01d85f837bef267.tmp" /SL5="$40016,47992881,136192,C:\Users\Admin\AppData\Local\Temp\a963d37c3649855102a6328e70acd8e00a983ef127cd8a8ad01d85f837bef267.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.0MB
MD5d138d33e04d9fe932a28ce27f6b2ffdc
SHA102fc5c7be8ae2b7893e6191e9683d1fb19eebf12
SHA256eecec38966cce281a516f8a1f2e25e5a50110d89aff0959c0665a5ddf5606eaf
SHA5124605e28fc17682e2802842c714feb4b8ca1fb4fbb5306a79cea8822f9b597286dfe6532add7fcde82291908e035e0db149009fbec0d24815f9127a91be6791d4
-
Filesize
784KB
MD5b2887d41753b031e39037f44583765c8
SHA118ff5ba679e4747388cc77febc88ee92d7802828
SHA256e2fcdcf1c447cb0da876eed12d74fe612e31677a9e433ef4ac5fcdbb34dc5a10
SHA51228202b0e3d9af75e5046b5cccdc2bb0874ae00a3cb2daf7e32a78e342de92add25ef58318411896975949a5b82dbb401d4896deeb4ab6343c123afe38469e3e3
-
Filesize
4KB
-
Filesize
836KB
-
Filesize
4KB
-
Filesize
160KB
-
Filesize
160KB