Analysis
-
max time kernel
122s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
20/03/2024, 01:23
General
-
Target
dea547d6a7660525d307a70934d8ef989f4d24f9511d5634f37e79ec79cf7f02.exe
-
Size
175KB
-
MD5
c8e84fd291de9d4cd5ee46ceaa16c328
-
SHA1
3c7a180a9cea75eaf1e9847ac0f90886a5d035ce
-
SHA256
dea547d6a7660525d307a70934d8ef989f4d24f9511d5634f37e79ec79cf7f02
-
SHA512
7009f2490455e4ad503c2acfe07366760063341f419ce08dfe7c9c093ab16b88d31226102ea0ddb79a0c38399188ec67e71adcd90d297901f6fcfa300297989d
-
SSDEEP
3072:7Iyh5eafsDUngyDx93w/gFlMYfr8WLdY5:7IA5yDKCIFlhfr8F
Score
7/10
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\dea547d6a7660525d307a70934d8ef989f4d24f9511d5634f37e79ec79cf7f02.exe"C:\Users\Admin\AppData\Local\Temp\dea547d6a7660525d307a70934d8ef989f4d24f9511d5634f37e79ec79cf7f02.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\dea547d6a7660525d307a70934d8ef989f4d24f9511d5634f37e79ec79cf7f02.exeC:\Users\Admin\AppData\Local\Temp\dea547d6a7660525d307a70934d8ef989f4d24f9511d5634f37e79ec79cf7f02.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
175KB
MD591dd920ee3b136fda450b463bf6a1b66
SHA16ab988897c81847683dc81f0e75b59a850f44afd
SHA256fac3544cb52482da243482b6e646c871077ce57e6173271a75d3f3d3b408dc25
SHA5127423230c492e0937de9111a14612a0da20392dd992106a8bbf2f4b078716e9cdd3b2d6b363877b5207b5a0810f0f6ead6b97a5fe438d554695e48e8799b406dd
-
Filesize
84KB
-
Filesize
204KB
-
Filesize
204KB
-
Filesize
204KB
-
Filesize
204KB