Analysis
-
max time kernel
119s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
16/04/2024, 19:20
General
-
Target
1497117ae662878a89c667bb10b251b22742eb0bd4871fe58befcde69c0364d2.exe
-
Size
720KB
-
MD5
a226a3fdac5c36ec4f89e34172556924
-
SHA1
5f3e7a0ad9717547dd4e1d78cc46ffc1faa9ec88
-
SHA256
1497117ae662878a89c667bb10b251b22742eb0bd4871fe58befcde69c0364d2
-
SHA512
b5f409b33e287745428e19a1eb5334b60ae7bb652d1cf64035e0feab89a02b0865dc691950620a742a7fc77afd370b4c99268dd5851d549408205e1198234942
-
SSDEEP
12288:SJQA2A6rc7cO/7F6D9d9pA6etej3uC+IOJ5D9d9pAn:JxXWhgZKnJp4
Score
7/10
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1497117ae662878a89c667bb10b251b22742eb0bd4871fe58befcde69c0364d2.exe"C:\Users\Admin\AppData\Local\Temp\1497117ae662878a89c667bb10b251b22742eb0bd4871fe58befcde69c0364d2.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1497117ae662878a89c667bb10b251b22742eb0bd4871fe58befcde69c0364d2.exeC:\Users\Admin\AppData\Local\Temp\1497117ae662878a89c667bb10b251b22742eb0bd4871fe58befcde69c0364d2.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
720KB
MD543ef98c5bd32ae6c5b617760dd9eaa7e
SHA125492a425e514e4ab6c25b4e05a5542ca20ad721
SHA256a7acfd610d4b91ffd7a328428088c41eecec9a36c93c2b475d6659a4e7475793
SHA512c683f293006f0710ea506ad1d4a1090d907e101617c1a911f774c4fba3a3ce43591cf72d9665e3c404395c5a467b6c2aca1d88527492ebf9dc07e145a312a6ec
-
Filesize
216KB
-
Filesize
216KB
-
Filesize
216KB
-
Filesize
216KB
-
Filesize
84KB