Analysis
-
max time kernel
120s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
13/03/2024, 01:51
General
-
Target
e20a12472d9f54b5db3505505e1ba15318f59db3c5c8dbf75a332f0cd775ddef.exe
-
Size
416KB
-
MD5
c36ecd56ae98e0ee58367cb76a1e16ea
-
SHA1
d8a145717dca1d08f2a649e1052d9ab034113083
-
SHA256
e20a12472d9f54b5db3505505e1ba15318f59db3c5c8dbf75a332f0cd775ddef
-
SHA512
f27a329a048c15f28e39694ade197a5c7386372ec1526811e40b351a8299df063bea3b6169bf7e108dc20216cf3ccd8be21f224fd335b15c18d1d30ac58ce4f9
-
SSDEEP
12288:urylwlxoQ76WjC7i/8wl6OVQ5zCD4TyWwiFAH4jKc:oyG3oQ76WjC7i/8lOVQ5zY4xwiFAH4j1
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e20a12472d9f54b5db3505505e1ba15318f59db3c5c8dbf75a332f0cd775ddef.exe"C:\Users\Admin\AppData\Local\Temp\e20a12472d9f54b5db3505505e1ba15318f59db3c5c8dbf75a332f0cd775ddef.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\e20a12472d9f54b5db3505505e1ba15318f59db3c5c8dbf75a332f0cd775ddef.exeC:\Users\Admin\AppData\Local\Temp\e20a12472d9f54b5db3505505e1ba15318f59db3c5c8dbf75a332f0cd775ddef.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
416KB
MD510175a3c5112227ae63223ec5328b60c
SHA1cf207a42aaf1b777b4bb83c05305170f1bffa6d1
SHA256828466e9418761d1298156c1e97ec7880dd059282e78ba7430e117d694533ac1
SHA512236a5dbecee1e2c9c7609825d4bf5609b97dac8a395239ede40c073da4e892640c352abfb3c3302cb238f2a24c4482bcf7aa0d5552e33bbc4abcf4fa1e4c4588
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
104KB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
256KB