Analysis
-
max time kernel
149s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
27/03/2024, 13:20
Behavioral task
behavioral1
Sample
e1c3b6720ad3987152b095751420a7e0.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
e1c3b6720ad3987152b095751420a7e0.exe
Resource
win10v2004-20240226-en
General
-
Target
e1c3b6720ad3987152b095751420a7e0.exe
-
Size
1.3MB
-
MD5
e1c3b6720ad3987152b095751420a7e0
-
SHA1
49b11f59dd407fc1127c6dd647555305b7874a2f
-
SHA256
08145540ca66ac439271ead365cd434316d9683bf4d4cd5d202446bc3e219f22
-
SHA512
028c3b199843d6cd6bf34fea1d2daac1b8926d61f2067dd382ca146bd95ba2a9c72b48989302bf95cd35aeb472cec027b96435705d327f22e0a942eb2ec4f71a
-
SSDEEP
24576:dXr3Rw42Np7yHzPRnDwUHrja/D3IzTaAZHGjGvq0lfgeQRRR5vRvG:xa4k7wzPRfK+NBGyLg/jLv
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2100 e1c3b6720ad3987152b095751420a7e0.exe -
Executes dropped EXE 1 IoCs
pid Process 2100 e1c3b6720ad3987152b095751420a7e0.exe -
resource yara_rule behavioral2/memory/4208-0-0x0000000000400000-0x000000000086A000-memory.dmp upx behavioral2/files/0x000400000002271f-13.dat upx behavioral2/memory/2100-15-0x0000000000400000-0x000000000086A000-memory.dmp upx -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 4208 e1c3b6720ad3987152b095751420a7e0.exe -
Suspicious use of UnmapMainImage 2 IoCs
pid Process 4208 e1c3b6720ad3987152b095751420a7e0.exe 2100 e1c3b6720ad3987152b095751420a7e0.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4208 wrote to memory of 2100 4208 e1c3b6720ad3987152b095751420a7e0.exe 99 PID 4208 wrote to memory of 2100 4208 e1c3b6720ad3987152b095751420a7e0.exe 99 PID 4208 wrote to memory of 2100 4208 e1c3b6720ad3987152b095751420a7e0.exe 99
Processes
-
C:\Users\Admin\AppData\Local\Temp\e1c3b6720ad3987152b095751420a7e0.exe"C:\Users\Admin\AppData\Local\Temp\e1c3b6720ad3987152b095751420a7e0.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:4208 -
C:\Users\Admin\AppData\Local\Temp\e1c3b6720ad3987152b095751420a7e0.exeC:\Users\Admin\AppData\Local\Temp\e1c3b6720ad3987152b095751420a7e0.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
PID:2100
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4440 --field-trial-handle=2248,i,10247514684337323751,15511974759131734137,262144 --variations-seed-version /prefetch:81⤵PID:5112
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
624KB
MD54b52d01a4cc8f2b6a12b4f8823921f69
SHA135b00d6d0d4858ca59f59bb3146b3feacab01876
SHA2569e6c5f4f3fe5f23f0a264357f9a8762a294ce35a86eec33081500e6fac728844
SHA5128a1cacdc4f03a165443925e84bf4bfacf04c4242452f7497ffcde7770e29388fed655075c62b4d5ef55ab94b001aceca7336efa9fceaacfc9ac760574eadcf5e