Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
11/04/2024, 04:08
Static task
static1
Behavioral task
behavioral1
Sample
ec41dcb9cd982cea0245b96205bc89155628c42a1cfb458de4bb794963d75b6d.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
ec41dcb9cd982cea0245b96205bc89155628c42a1cfb458de4bb794963d75b6d.exe
Resource
win10v2004-20240226-en
General
-
Target
ec41dcb9cd982cea0245b96205bc89155628c42a1cfb458de4bb794963d75b6d.exe
-
Size
1.0MB
-
MD5
492a30b86e99cabfc13a4a634d7884df
-
SHA1
ecb0e8185d1660bf91584d97d1b1dda036fb25fc
-
SHA256
ec41dcb9cd982cea0245b96205bc89155628c42a1cfb458de4bb794963d75b6d
-
SHA512
c847c39df268c6b5641f278f68b18669b7277278732abb6592880240c0b8b163e4d1a834ce03076c3e10ca985e5b47411fa8e2d05efde5f4aaf106aabd924a70
-
SSDEEP
24576:KaObU4A2jOVPL7AVfXMmqaZNBLZmN1VUZmUt0SOaWU0+tyvhBDlsyzt5EkmGEHo5:KaO0K6LA0mlZmXiZmUt0SOaWU04yvHDZ
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2052 1748.tmp -
Executes dropped EXE 1 IoCs
pid Process 2052 1748.tmp -
Loads dropped DLL 1 IoCs
pid Process 1752 ec41dcb9cd982cea0245b96205bc89155628c42a1cfb458de4bb794963d75b6d.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1752 wrote to memory of 2052 1752 ec41dcb9cd982cea0245b96205bc89155628c42a1cfb458de4bb794963d75b6d.exe 28 PID 1752 wrote to memory of 2052 1752 ec41dcb9cd982cea0245b96205bc89155628c42a1cfb458de4bb794963d75b6d.exe 28 PID 1752 wrote to memory of 2052 1752 ec41dcb9cd982cea0245b96205bc89155628c42a1cfb458de4bb794963d75b6d.exe 28 PID 1752 wrote to memory of 2052 1752 ec41dcb9cd982cea0245b96205bc89155628c42a1cfb458de4bb794963d75b6d.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\ec41dcb9cd982cea0245b96205bc89155628c42a1cfb458de4bb794963d75b6d.exe"C:\Users\Admin\AppData\Local\Temp\ec41dcb9cd982cea0245b96205bc89155628c42a1cfb458de4bb794963d75b6d.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1752 -
C:\Users\Admin\AppData\Local\Temp\1748.tmp"C:\Users\Admin\AppData\Local\Temp\1748.tmp"2⤵
- Deletes itself
- Executes dropped EXE
PID:2052
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.0MB
MD56c9651f369bf8815e04d62501d04a580
SHA1d5d27af9177fdc49c1f9e57d7c06bf4203fa1b1d
SHA256fa2190e8fd681c49faca109c9e62f44ee7108a8f198ddb9396fc4ff2a01e976e
SHA512650c08c71dee5ce2e0970a25f2ff4dc395a8a5cfffb67ef232a5916c77786ee12a52618bed3314655b55aa18c2ff6e08f59d4821bc84661a37aca1ed929a9864