Overview

overview

7

Static

static

3

b02e8d1b32...56.exe

windows7-x64

7

b02e8d1b32...56.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    121s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    25/03/2024, 20:43

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    b02e8d1b32879db8f7eb335ac0c0a43287612e8234deba45dfba624ae1117956.exe

  • Size

    668KB

  • MD5

    065ac57995cf18d6d237b105b42a3d03

  • SHA1

    f62345a3593073597b46321b11af343435f8d053

  • SHA256

    b02e8d1b32879db8f7eb335ac0c0a43287612e8234deba45dfba624ae1117956

  • SHA512

    78610b46d8b534fc473dfdaa72d1ead1c4200cdb3474f75d3125e2e4383823280d72cb67675851fe23e3a4d1324d3041549fcdc681d016195352b0c1f73cba85

  • SSDEEP

    12288:xeO93+nxZYtXDKlJDHUVQ5zCN2j6FB5WMlL143VQ5zCSjdgEi0kXz:cO93+n7YtTKlJDHUVQ5zg2mblLO3VQ5u

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b02e8d1b32879db8f7eb335ac0c0a43287612e8234deba45dfba624ae1117956.exe
    "C:\Users\Admin\AppData\Local\Temp\b02e8d1b32879db8f7eb335ac0c0a43287612e8234deba45dfba624ae1117956.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: RenamesItself
    • Suspicious use of WriteProcessMemory
    PID:2676
    • C:\Users\Admin\AppData\Local\Temp\b02e8d1b32879db8f7eb335ac0c0a43287612e8234deba45dfba624ae1117956.exe
      C:\Users\Admin\AppData\Local\Temp\b02e8d1b32879db8f7eb335ac0c0a43287612e8234deba45dfba624ae1117956.exe
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Suspicious use of UnmapMainImage
      PID:2864

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • \Users\Admin\AppData\Local\Temp\b02e8d1b32879db8f7eb335ac0c0a43287612e8234deba45dfba624ae1117956.exe
          Filesize

          668KB

          MD5

          24ddc62f875da091376a52060fe82ca9

          SHA1

          62c2445208275adef956d8f794e7da2782ff5a68

          SHA256

          15ed4e5c4adf47ffbc1d7df749e1a71890ea69af7c5ac81020fd954d829b22a7

          SHA512

          20124f8d9f074bda21cb6b20c2240ce16cf5b2c0031a9a9bcf99c0923f0bf78cd1c302f9a68161fce7e4dc93cef024bbfdc61001c8844c0c565d51b702f83230

          Download Submit

        • memory/2676-0-0x0000000000400000-0x0000000000441000-memory.dmp

          Filesize

          260KB

          Download

        • memory/2676-9-0x0000000000400000-0x0000000000441000-memory.dmp

          Filesize

          260KB

          Download

        • memory/2864-10-0x0000000000400000-0x0000000000441000-memory.dmp

          Filesize

          260KB

          Download

        • memory/2864-11-0x0000000000400000-0x000000000041A000-memory.dmp

          Filesize

          104KB

          Download

        • memory/2864-16-0x0000000000360000-0x00000000003A1000-memory.dmp

          Filesize

          260KB

          Download