Analysis
-
max time kernel
120s -
max time network
136s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
12/03/2024, 23:23
General
-
Target
a03af0792c4004f735eceb082f3553023352cfebfd5074b5f368f7034304299c.exe
-
Size
218KB
-
MD5
bf81c7a53f1a8f06656310c6db06192d
-
SHA1
764775f18f5831d8c123f509bf7fdfb0faf334d3
-
SHA256
a03af0792c4004f735eceb082f3553023352cfebfd5074b5f368f7034304299c
-
SHA512
2a78919eb297493b451c025dbd48b3e48d3153ea54cec892e17d2ffdfd82decd01b7a21c54072ee81df68a402b4b37111cdb7e23a12b95ba91479e25b329bcf5
-
SSDEEP
6144:BCxv238V3sOZ/YRDkrXH9+/MGraivybVnKX9aLisM+Nea:z3U9ZSoXd+/nraivybVKX9aLisvNea
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a03af0792c4004f735eceb082f3553023352cfebfd5074b5f368f7034304299c.exe"C:\Users\Admin\AppData\Local\Temp\a03af0792c4004f735eceb082f3553023352cfebfd5074b5f368f7034304299c.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\a03af0792c4004f735eceb082f3553023352cfebfd5074b5f368f7034304299c.exeC:\Users\Admin\AppData\Local\Temp\a03af0792c4004f735eceb082f3553023352cfebfd5074b5f368f7034304299c.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
218KB
MD53e261da9ff46655cd2d7133cec7c24d6
SHA18520500cb5dfa62503d2a3001b8327fc67a4e92f
SHA256a8963c4987242d0722cd880d03eac740f81955b8ba0d83de600d264c2c9aa6cc
SHA5122d049cf075fab94f9a26ac6515a55fa7471e24d9966773259d929ed652e5c422a5b12dde5982fad8941c7388e8b5d9ffbc12fa6b7051184f2bd43d5e79720c5b
-
Filesize
264KB
-
Filesize
104KB
-
Filesize
264KB
-
Filesize
264KB
-
Filesize
264KB
-
Filesize
264KB