Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
-
submitted
15/03/2024, 02:36
General
-
Target
ca4469f93269d98a110fc02c2f0d8e2d.exe
-
Size
82KB
-
MD5
ca4469f93269d98a110fc02c2f0d8e2d
-
SHA1
d5da46e2354859320e48525b2b36a70da0e07882
-
SHA256
787f64d6aa57a62d8cfd149d870859bcf286d2e13380701c400c01635abd043f
-
SHA512
9792f3ad29a88b302daa504f714762ab0ca73f06cc18d4354a7627549327ee8b3280174827c5b186205abaa97a9b66e2c4a8407b3e96ca1ff0752913e3bf5211
-
SSDEEP
1536:XX4P9KfDWYNE1Fmjbsd2ttVAjwBI2jvAajptm/RvFr9PMH8uemAV4Wwgd8f613gK:YPuELTdFj1qAajXItr9kHBpXWoy1pF
Score
7/10
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ca4469f93269d98a110fc02c2f0d8e2d.exe"C:\Users\Admin\AppData\Local\Temp\ca4469f93269d98a110fc02c2f0d8e2d.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ca4469f93269d98a110fc02c2f0d8e2d.exeC:\Users\Admin\AppData\Local\Temp\ca4469f93269d98a110fc02c2f0d8e2d.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
82KB
MD54976f9b093e6e95cf8744b5a86436c67
SHA17118f84d7c1e44b7a87a61cf93f5ccfb08be3853
SHA2565e5beca0a12a92884be362db7e2204c8ce141ca98878f045e536dd55198148ee
SHA5129b95f4aa7b2f657095bc2116c2adba3f85d1996a8ecad32755e13e2952bd2664ff87df4c4acfdb37c1de9d8e184ced98cda89ac4e0c09918d05537b891e2dbf2
-
Filesize
188KB
-
Filesize
188KB
-
Filesize
108KB
-
Filesize
108KB
-
Filesize
188KB
-
Filesize
188KB
-
Filesize
56KB
-
Filesize
108KB