Analysis
-
max time kernel
120s -
max time network
133s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
27/03/2024, 13:20
Behavioral task
behavioral1
Sample
e1c3b6720ad3987152b095751420a7e0.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
e1c3b6720ad3987152b095751420a7e0.exe
Resource
win10v2004-20240226-en
General
-
Target
e1c3b6720ad3987152b095751420a7e0.exe
-
Size
1.3MB
-
MD5
e1c3b6720ad3987152b095751420a7e0
-
SHA1
49b11f59dd407fc1127c6dd647555305b7874a2f
-
SHA256
08145540ca66ac439271ead365cd434316d9683bf4d4cd5d202446bc3e219f22
-
SHA512
028c3b199843d6cd6bf34fea1d2daac1b8926d61f2067dd382ca146bd95ba2a9c72b48989302bf95cd35aeb472cec027b96435705d327f22e0a942eb2ec4f71a
-
SSDEEP
24576:dXr3Rw42Np7yHzPRnDwUHrja/D3IzTaAZHGjGvq0lfgeQRRR5vRvG:xa4k7wzPRfK+NBGyLg/jLv
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2568 e1c3b6720ad3987152b095751420a7e0.exe -
Executes dropped EXE 1 IoCs
pid Process 2568 e1c3b6720ad3987152b095751420a7e0.exe -
Loads dropped DLL 1 IoCs
pid Process 2032 e1c3b6720ad3987152b095751420a7e0.exe -
resource yara_rule behavioral1/memory/2032-0-0x0000000000400000-0x000000000086A000-memory.dmp upx behavioral1/files/0x000d000000012225-13.dat upx behavioral1/memory/2568-17-0x0000000000400000-0x000000000086A000-memory.dmp upx -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 2032 e1c3b6720ad3987152b095751420a7e0.exe -
Suspicious use of UnmapMainImage 2 IoCs
pid Process 2032 e1c3b6720ad3987152b095751420a7e0.exe 2568 e1c3b6720ad3987152b095751420a7e0.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2032 wrote to memory of 2568 2032 e1c3b6720ad3987152b095751420a7e0.exe 28 PID 2032 wrote to memory of 2568 2032 e1c3b6720ad3987152b095751420a7e0.exe 28 PID 2032 wrote to memory of 2568 2032 e1c3b6720ad3987152b095751420a7e0.exe 28 PID 2032 wrote to memory of 2568 2032 e1c3b6720ad3987152b095751420a7e0.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\e1c3b6720ad3987152b095751420a7e0.exe"C:\Users\Admin\AppData\Local\Temp\e1c3b6720ad3987152b095751420a7e0.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2032 -
C:\Users\Admin\AppData\Local\Temp\e1c3b6720ad3987152b095751420a7e0.exeC:\Users\Admin\AppData\Local\Temp\e1c3b6720ad3987152b095751420a7e0.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
PID:2568
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.3MB
MD5f1db33100270bfd94d2949bc86f23afd
SHA1884fc584b69396a2844c43bff838b5e86be89f75
SHA2562a3e1f84cef4af2b71ab5ca32adcf82a55fd0ffe829ba3d62f457b94737df53e
SHA512697af81596c351363b12e99579fce397bc2b3389bc9c8c9b891217ccd2baed18e8b28eb97d2974a236da4710627531cebaddf4f997fb5512f9645738b832bb5a