Analysis
-
max time kernel
121s -
max time network
129s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
27-03-2024 03:49
General
-
Target
e0b27a60f7acb8ffc6386ebc3f80b982.exe
-
Size
105KB
-
MD5
e0b27a60f7acb8ffc6386ebc3f80b982
-
SHA1
dbaeeb92fe4529868a6da88821879ddee968523b
-
SHA256
48a839910c4ee1902307de543d27bcf6283b7806b0701e6862f1f4088ba499df
-
SHA512
1739a94af4c2d56c2be9134d716b89141febf9af46d43a0a943119734ab53c74f0ba43772d69400875cb944edddac8190eaeb5cdc34bbc401c9833c592479d34
-
SSDEEP
1536:M1IYtinNJq8Of4rDn50dGEnVJdEMmw6lIqY1/SXbXYW2Q7HOPL0iTt6DtW9YH:gHtMNJq8xVqGEnmMslIqSq8Q7uT2pW9i
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e0b27a60f7acb8ffc6386ebc3f80b982.exe"C:\Users\Admin\AppData\Local\Temp\e0b27a60f7acb8ffc6386ebc3f80b982.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\e0b27a60f7acb8ffc6386ebc3f80b982.exeC:\Users\Admin\AppData\Local\Temp\e0b27a60f7acb8ffc6386ebc3f80b982.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
105KB
MD5d9375885790f9c80ac805461fc57f4ad
SHA1a43868b4e7a520561dcbea8b5c22793c39b40c5c
SHA256aaa86440f6eb01a3db741bb9cfe36b20c047518aeacb302b12f406733ca9d7ab
SHA512b2c78addb1196ca35f97f58b6e040c18f323de1ce0bc831f912c95ae73652b909cc5c919ed01468b85d3aebfe787323f60de5bbc10f3ad0dfe5f198bb3918d2d
-
Filesize
188KB
-
Filesize
188KB
-
Filesize
56KB
-
Filesize
108KB
-
Filesize
188KB
-
Filesize
108KB
-
Filesize
188KB
-
Filesize
188KB
-
Filesize
108KB