Analysis
-
max time kernel
18s -
max time network
20s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
-
submitted
22-04-2024 16:34
General
-
Target
downloader.exe
-
Size
73KB
-
MD5
b4364fe399ec3ab68991570b434c9697
-
SHA1
a2ad7dacf51ad9130b0c41a5d023d0ca7f784340
-
SHA256
b9ccfbd0d32cafbff2d0fc02cb757761ae85bdc14724b3d2a592442f1e5e8232
-
SHA512
8b316f06d0a6de8d5d4445fca83afd382fb223194149b34082f417333df88fd7f2a1087f43e7fe6f61360ec1342fff001ab51d9a88ad8dc814f9c51b236f375d
-
SSDEEP
1536:Hu7jEOj/U2SwQ0gi2+VyYoFwiL8HfHFs:O7Rj4wQH5MyYoFXafH
Malware Config
Signatures
-
Downloads MZ/PE file
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
VMProtect packed file 1 IoCs
Detects executables packed with VMProtect commercial packer.
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\downloader.exe"C:\Users\Admin\AppData\Local\Temp\downloader.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\.injector.com".injector.com"2⤵
- Executes dropped EXE
- Loads dropped DLL
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\.injector.comFilesize
7.5MB
MD527245053e6e22f1d00e3af8363d32718
SHA18778faff00eb13ee9ed94859bb7011bc525b0953
SHA256b65652692c22497d5af02986960ca6e7d6eec9870f798f6cab315bb7fc87fe33
SHA512fdb5ff309838814d664c9dc9058ea66cb504a70c81d4c580d47cb8847096947caf374367e273407eedf3dc0a5af3f42833e522b06788ae63fed532517d35991b
-
C:\Users\Admin\AppData\Local\Temp\libcrypto-3-x64.dllFilesize
4.3MB
MD50f0b3835d70f633c63e3d1acd06cb956
SHA1fda6f8404f9e3ca635291f9ac9dfe4eb004b375b
SHA256be0e7a1cc20d153e1af95489a0fbf2be4eda6bc160b2892f042d2a13cdb9e39e
SHA5124e35dbf65a910ae5a011a76d6c8109b56205accf1845b1600f8badd20a5d6685410be049ab2d8cc0c17e5091c1cfc8b571e42220ffafaf196d5ef80789e8e46c