Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
15-03-2024 23:04
General
-
Target
b498972c2cdce81ef9cd6198f34a6f270277909681d9935a54421e05bb96de03.exe
-
Size
481KB
-
MD5
3d8fde6d8c19cd43c3c9240b48d97ba0
-
SHA1
f10c9032ef8596c6a09e423ab0829b5c0503532e
-
SHA256
b498972c2cdce81ef9cd6198f34a6f270277909681d9935a54421e05bb96de03
-
SHA512
eb2ea11683babb55ebb0189673b5390f33e3da1ac1e71a178e538c32efae53c0534ea6ffac19e5506a5984496ad5cfd41c964d991ef96f43a467b1bdd27cdda4
-
SSDEEP
12288:INdt8uN4lf+wxqkAhGKYvc8v9881Cv3yNuPSm4/MnEfJThTOVYUltc5gLE4k2Ewa:Em6x3yNuPgMnEfJThTOVYUlOmLE43Ewa
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b498972c2cdce81ef9cd6198f34a6f270277909681d9935a54421e05bb96de03.exe"C:\Users\Admin\AppData\Local\Temp\b498972c2cdce81ef9cd6198f34a6f270277909681d9935a54421e05bb96de03.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\b498972c2cdce81ef9cd6198f34a6f270277909681d9935a54421e05bb96de03.exeC:\Users\Admin\AppData\Local\Temp\b498972c2cdce81ef9cd6198f34a6f270277909681d9935a54421e05bb96de03.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
481KB
MD5646403d43bfe3997b64cdd185038e005
SHA161136dcbb114a1041f721718373846e5fe5d2362
SHA2562b9523b62fa47dc9f04d9124b734ddcf05a72ece44844c2359061b1486015833
SHA512d1dca5be27740502089a293280c41b0c8622d4d207942b5f7d02eda936045c5fbd95f7adedb21e3adb5c516d9ef50578d4c1925e22068550576069030209fc63
-
Filesize
280KB
-
Filesize
280KB
-
Filesize
104KB
-
Filesize
280KB
-
Filesize
280KB