Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
14/03/2024, 22:20
Static task
static1
Behavioral task
behavioral1
Sample
c9c2ffb887731bfb00c00f1cb2efa4fc.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
c9c2ffb887731bfb00c00f1cb2efa4fc.exe
Resource
win10v2004-20240226-en
General
-
Target
c9c2ffb887731bfb00c00f1cb2efa4fc.exe
-
Size
1.9MB
-
MD5
c9c2ffb887731bfb00c00f1cb2efa4fc
-
SHA1
4542e49a61411cb309ee9298c4262b5644de162f
-
SHA256
515e8fddf9d66c4623ee058e4b9c871134b373b96f21ba2961ff18c8c8f59e72
-
SHA512
a0a543b68a4e1efa04ff57763dd3c788e3fb65c080d26cfa50a6e7d7ab9e46396e2a61a397fbc817cc196c95da662d1cbb2467092bfc11dac25aa1ff2ddb1dae
-
SSDEEP
24576:N2oo60HPdt+1CRiY2eOBvcj3u10d2FRVwSyFTwnIbntO0VPk/LbS6V+GAEepoH0R:Qoa1taC070dPDJXwJ3FExj4IlUanbCc
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 1656 D88.tmp -
Executes dropped EXE 1 IoCs
pid Process 1656 D88.tmp -
Loads dropped DLL 1 IoCs
pid Process 2968 c9c2ffb887731bfb00c00f1cb2efa4fc.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2968 wrote to memory of 1656 2968 c9c2ffb887731bfb00c00f1cb2efa4fc.exe 28 PID 2968 wrote to memory of 1656 2968 c9c2ffb887731bfb00c00f1cb2efa4fc.exe 28 PID 2968 wrote to memory of 1656 2968 c9c2ffb887731bfb00c00f1cb2efa4fc.exe 28 PID 2968 wrote to memory of 1656 2968 c9c2ffb887731bfb00c00f1cb2efa4fc.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\c9c2ffb887731bfb00c00f1cb2efa4fc.exe"C:\Users\Admin\AppData\Local\Temp\c9c2ffb887731bfb00c00f1cb2efa4fc.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2968 -
C:\Users\Admin\AppData\Local\Temp\D88.tmp"C:\Users\Admin\AppData\Local\Temp\D88.tmp" --splashC:\Users\Admin\AppData\Local\Temp\c9c2ffb887731bfb00c00f1cb2efa4fc.exe 476713BFDFB1FCD1412F2AA2A4ABA2B9F84200A84B8958247672B10561A0036D70EB447236114CD6BBA19466A88FBDC1F54ACB8B3326916F413402DBD8D985832⤵
- Deletes itself
- Executes dropped EXE
PID:1656
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.9MB
MD5929bc29ed078d47f39d4405d0225611c
SHA1803c4de13cf785acfff5788e9b1cca14f6847dca
SHA256ad2ead3d6e5907ac20980e0cfd11a5e8c46163427f70da56582ad25598d03c58
SHA51295e04e314f3d6ba1e872415394cac157e298e5843107ad0369161161541d3dab970607af87dd342f8c1ebe93ac1d114848c1c78157c281890a34cc29c7bfd972