Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
25-03-2024 21:05
General
-
Target
bfbf4bcee863463dc9eaccf0b3427411603c8ffb130ffe3961edb3fed7c7c175.exe
-
Size
333KB
-
MD5
7853a901abc177a77191bdbe62dfc5dc
-
SHA1
6d40877b1b2d0aa242044cb0d9fe55a615b0982d
-
SHA256
bfbf4bcee863463dc9eaccf0b3427411603c8ffb130ffe3961edb3fed7c7c175
-
SHA512
d57b4ccd65beb3150bda12fc8d452ad49454786fdc4253a228ff9913fc650db0976402b78356bfc271294cb265b49c4871fb5fd84262795a09f37bc648992104
-
SSDEEP
6144:8eQHMSuScUMC1UZrsxvj69yy6atBWONLRIaUOkKr:qHbsC1UZrs9j697trIahP
Score
7/10
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\bfbf4bcee863463dc9eaccf0b3427411603c8ffb130ffe3961edb3fed7c7c175.exe"C:\Users\Admin\AppData\Local\Temp\bfbf4bcee863463dc9eaccf0b3427411603c8ffb130ffe3961edb3fed7c7c175.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\bfbf4bcee863463dc9eaccf0b3427411603c8ffb130ffe3961edb3fed7c7c175.exeC:\Users\Admin\AppData\Local\Temp\bfbf4bcee863463dc9eaccf0b3427411603c8ffb130ffe3961edb3fed7c7c175.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
333KB
MD5c0df6026c3237a247937b8fdd7cc987b
SHA163ebf8aee176d21e3b2545f2e281ccd36e054c43
SHA2568cf88933adbb06caebe418d8e8981ab17d25d3d214cc579466b7ad255efe1c45
SHA512ad86931adef734c1a8ae30a3e377a4079d131501afb75a019e947ba260d436a746ac6867767ab40108bc97a56ea6ab63ff714d33ee2c1b7c7f11af4fff816fd3
-
Filesize
224KB
-
Filesize
224KB
-
Filesize
224KB
-
Filesize
104KB
-
Filesize
224KB
-
Filesize
224KB