Analysis
-
max time kernel
117s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
13/03/2024, 14:48
General
-
Target
c625c6b6552796ae158ca4e28edbaa32.exe
-
Size
409KB
-
MD5
c625c6b6552796ae158ca4e28edbaa32
-
SHA1
7d098449ae05528f2cfcb25e3b7e68a7ac15bbca
-
SHA256
0aaf709fde4631cddc2e32aa6f27d73630fd72c6275d9b8f1333f91619eee823
-
SHA512
c23b6d8b371c769789e1a3547098ad5a2e5d415a6f93e3709dbfb2bc3dd52041323ec5047cb1c6dbb1b8ca8a20795b328c9fc81e94e0a95fc8fcb3e3bce8de3e
-
SSDEEP
6144:x1BZJ9vp9qGQ9EA6fBjw0lgRhGY29QOlKtPbvV8DvE19EHcUsaDg3f:DBL5pEoBUKgzk9QOlKVdYs1KHcUsay
Score
7/10
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c625c6b6552796ae158ca4e28edbaa32.exe"C:\Users\Admin\AppData\Local\Temp\c625c6b6552796ae158ca4e28edbaa32.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\c625c6b6552796ae158ca4e28edbaa32.exeC:\Users\Admin\AppData\Local\Temp\c625c6b6552796ae158ca4e28edbaa32.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
409KB
MD5d360dd532287f8f731aa770afaa78b46
SHA126c09a81174e05e26b741d29b8efa0c6fce532fb
SHA25657213d8fc9d35f064a27be0692084ae609ec739c18c572cde2485a9b8c1890d4
SHA5125f9bc766f6dee242abddd030726ba3e90a7c0e5330858dd2d4ee9f5a0de23e367cd142869476a50347eadeda9b96425046da5b350ab0434fcd4304a9e5b64228
-
Filesize
228KB
-
Filesize
228KB
-
Filesize
56KB
-
Filesize
200KB
-
Filesize
228KB
-
Filesize
228KB
-
Filesize
200KB
-
Filesize
228KB
-
Filesize
200KB