Analysis
-
max time kernel
119s -
max time network
129s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
26/03/2024, 14:34
Static task
static1
Behavioral task
behavioral1
Sample
df664f94e47dae1e4b0b209241389879.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
df664f94e47dae1e4b0b209241389879.exe
Resource
win10v2004-20240226-en
General
-
Target
df664f94e47dae1e4b0b209241389879.exe
-
Size
82KB
-
MD5
df664f94e47dae1e4b0b209241389879
-
SHA1
773b1a2b82ecec28f1b8d8edcc97ece14db006d6
-
SHA256
7df209cff6511556b14e8ef957b513b82ba6ad4e0a35e15da1be0186ed447518
-
SHA512
22ab79eba6ff159f1352ce86d9fa3bf3e2999555a02d5913a090a01a962663633636a331fab812721fd281ca668d02b4984e34ea4ae97607048d9045119890e6
-
SSDEEP
1536:WWOCglG3vjk0zWKo7xO4r82pL4eBZ7V1AhZ:9OvG3vQ0Ho7xO41pL4eEhZ
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 1812 df664f94e47dae1e4b0b209241389879.exe -
Executes dropped EXE 1 IoCs
pid Process 1812 df664f94e47dae1e4b0b209241389879.exe -
Loads dropped DLL 1 IoCs
pid Process 1972 df664f94e47dae1e4b0b209241389879.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 1972 df664f94e47dae1e4b0b209241389879.exe -
Suspicious use of UnmapMainImage 2 IoCs
pid Process 1972 df664f94e47dae1e4b0b209241389879.exe 1812 df664f94e47dae1e4b0b209241389879.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1972 wrote to memory of 1812 1972 df664f94e47dae1e4b0b209241389879.exe 29 PID 1972 wrote to memory of 1812 1972 df664f94e47dae1e4b0b209241389879.exe 29 PID 1972 wrote to memory of 1812 1972 df664f94e47dae1e4b0b209241389879.exe 29 PID 1972 wrote to memory of 1812 1972 df664f94e47dae1e4b0b209241389879.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\df664f94e47dae1e4b0b209241389879.exe"C:\Users\Admin\AppData\Local\Temp\df664f94e47dae1e4b0b209241389879.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1972 -
C:\Users\Admin\AppData\Local\Temp\df664f94e47dae1e4b0b209241389879.exeC:\Users\Admin\AppData\Local\Temp\df664f94e47dae1e4b0b209241389879.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
PID:1812
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
82KB
MD574445b2f63c2f3bc91010997741b8b59
SHA10336bd4a6a1ec6dc8af97727a77a61020c63ac6e
SHA2563e8571b09b003764f9635b2a22604f4423cd77d50771e3dfe5be72fc337a508b
SHA5122d3da19b5e981aa63ddd90d8f4e0ee22e8b8f050aa9679c3fad88ff3b42224e3c0eea01678d75f28a2215445621a4356bc3364598dc2b36b1a63d852cc09a983