Analysis
-
max time kernel
117s -
max time network
117s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
10-04-2024 08:05
Static task
static1
Behavioral task
behavioral1
Sample
fe2982abd3fbb02808da5892a6a262bccdd0b8650c79fb2d6e2f1fd401297da5.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
fe2982abd3fbb02808da5892a6a262bccdd0b8650c79fb2d6e2f1fd401297da5.exe
Resource
win10v2004-20231215-en
General
-
Target
fe2982abd3fbb02808da5892a6a262bccdd0b8650c79fb2d6e2f1fd401297da5.exe
-
Size
714KB
-
MD5
c9470058cca0e1cb82d4c0a07fecd0db
-
SHA1
a66d76d86448965e57d7be96a57529c497e4b99d
-
SHA256
fe2982abd3fbb02808da5892a6a262bccdd0b8650c79fb2d6e2f1fd401297da5
-
SHA512
ec8cc6b45e2703ee8c227a0fe7d3e1efb999ae0de583cc98e7ef7aa932f686fc06bea21081be19a2cc11e784ab7161129ecd7288bae971b4fce7fba44296388a
-
SSDEEP
12288:eo01IzLB/XV/tboClV+tFHxMfR+G1x2VK8PTkKE2qtFL/MLsJT5X:eLMb/xoClV+tFRMfRuk528L/M8T5X
Malware Config
Signatures
-
Deletes itself 1 IoCs
Processes:
.fe2982abd3fbb02808da5892a6a262bccdd0b8650c79fb2d6e2f1fd401297da5.wzvtgwarpoliswjspierzhnqvctingww.__selfdelete__.exepid process 1744 .fe2982abd3fbb02808da5892a6a262bccdd0b8650c79fb2d6e2f1fd401297da5.wzvtgwarpoliswjspierzhnqvctingww.__selfdelete__.exe -
Executes dropped EXE 1 IoCs
Processes:
.fe2982abd3fbb02808da5892a6a262bccdd0b8650c79fb2d6e2f1fd401297da5.wzvtgwarpoliswjspierzhnqvctingww.__selfdelete__.exepid process 1744 .fe2982abd3fbb02808da5892a6a262bccdd0b8650c79fb2d6e2f1fd401297da5.wzvtgwarpoliswjspierzhnqvctingww.__selfdelete__.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
fe2982abd3fbb02808da5892a6a262bccdd0b8650c79fb2d6e2f1fd401297da5.exepid process 1728 fe2982abd3fbb02808da5892a6a262bccdd0b8650c79fb2d6e2f1fd401297da5.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
fe2982abd3fbb02808da5892a6a262bccdd0b8650c79fb2d6e2f1fd401297da5.exe.fe2982abd3fbb02808da5892a6a262bccdd0b8650c79fb2d6e2f1fd401297da5.wzvtgwarpoliswjspierzhnqvctingww.__selfdelete__.exedescription pid process target process PID 1728 wrote to memory of 1744 1728 fe2982abd3fbb02808da5892a6a262bccdd0b8650c79fb2d6e2f1fd401297da5.exe .fe2982abd3fbb02808da5892a6a262bccdd0b8650c79fb2d6e2f1fd401297da5.wzvtgwarpoliswjspierzhnqvctingww.__selfdelete__.exe PID 1728 wrote to memory of 1744 1728 fe2982abd3fbb02808da5892a6a262bccdd0b8650c79fb2d6e2f1fd401297da5.exe .fe2982abd3fbb02808da5892a6a262bccdd0b8650c79fb2d6e2f1fd401297da5.wzvtgwarpoliswjspierzhnqvctingww.__selfdelete__.exe PID 1728 wrote to memory of 1744 1728 fe2982abd3fbb02808da5892a6a262bccdd0b8650c79fb2d6e2f1fd401297da5.exe .fe2982abd3fbb02808da5892a6a262bccdd0b8650c79fb2d6e2f1fd401297da5.wzvtgwarpoliswjspierzhnqvctingww.__selfdelete__.exe PID 1744 wrote to memory of 2604 1744 .fe2982abd3fbb02808da5892a6a262bccdd0b8650c79fb2d6e2f1fd401297da5.wzvtgwarpoliswjspierzhnqvctingww.__selfdelete__.exe cmd.exe PID 1744 wrote to memory of 2604 1744 .fe2982abd3fbb02808da5892a6a262bccdd0b8650c79fb2d6e2f1fd401297da5.wzvtgwarpoliswjspierzhnqvctingww.__selfdelete__.exe cmd.exe PID 1744 wrote to memory of 2604 1744 .fe2982abd3fbb02808da5892a6a262bccdd0b8650c79fb2d6e2f1fd401297da5.wzvtgwarpoliswjspierzhnqvctingww.__selfdelete__.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\fe2982abd3fbb02808da5892a6a262bccdd0b8650c79fb2d6e2f1fd401297da5.exe"C:\Users\Admin\AppData\Local\Temp\fe2982abd3fbb02808da5892a6a262bccdd0b8650c79fb2d6e2f1fd401297da5.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\.fe2982abd3fbb02808da5892a6a262bccdd0b8650c79fb2d6e2f1fd401297da5.wzvtgwarpoliswjspierzhnqvctingww.__selfdelete__.exe"C:\Users\Admin\AppData\Local\Temp\.fe2982abd3fbb02808da5892a6a262bccdd0b8650c79fb2d6e2f1fd401297da5.wzvtgwarpoliswjspierzhnqvctingww.__selfdelete__.exe" 240 C:\Users\Admin\AppData\Local\Temp\.fe2982abd3fbb02808da5892a6a262bccdd0b8650c79fb2d6e2f1fd401297da5.fuirvrxpjgqcjmebvbgatgtyfkwrwyxe.__relocated__.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.execmd.exe /c exit3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\.fe2982abd3fbb02808da5892a6a262bccdd0b8650c79fb2d6e2f1fd401297da5.wzvtgwarpoliswjspierzhnqvctingww.__selfdelete__.exeFilesize
714KB
MD5c9470058cca0e1cb82d4c0a07fecd0db
SHA1a66d76d86448965e57d7be96a57529c497e4b99d
SHA256fe2982abd3fbb02808da5892a6a262bccdd0b8650c79fb2d6e2f1fd401297da5
SHA512ec8cc6b45e2703ee8c227a0fe7d3e1efb999ae0de583cc98e7ef7aa932f686fc06bea21081be19a2cc11e784ab7161129ecd7288bae971b4fce7fba44296388a