Analysis
-
max time kernel
118s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
02-05-2024 04:00
Static task
static1
Behavioral task
behavioral1
Sample
d18fc730b89f645e6ddb13c7c6d54041ac8b1d2a6677502ef792f8e74988e3d7.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
d18fc730b89f645e6ddb13c7c6d54041ac8b1d2a6677502ef792f8e74988e3d7.exe
Resource
win10v2004-20240419-en
General
-
Target
d18fc730b89f645e6ddb13c7c6d54041ac8b1d2a6677502ef792f8e74988e3d7.exe
-
Size
197KB
-
MD5
b9ed244d0ae3dc5000c6fb1640e0066b
-
SHA1
5be79bbfa43132c81aee7a097fd20f46d537c9c6
-
SHA256
d18fc730b89f645e6ddb13c7c6d54041ac8b1d2a6677502ef792f8e74988e3d7
-
SHA512
68dd935f443a86ea6cb85030532af67aa3b8eae26c1c88027b8e63c2c0155bd592a3309e4794e19dc1875fa691df93369eeae13125f08419be504035df616689
-
SSDEEP
3072:0fAZeNa3xriqJ/HTCA2xWhGBIW4qQyiU4RlNayavQUOTxcD4gcUP0+VY9kWG8H6v:0fAD/lhy+bNHzTuHPCyGH6Y6l
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2156 d18fc730b89f645e6ddb13c7c6d54041ac8b1d2a6677502ef792f8e74988e3d7.exe -
Executes dropped EXE 1 IoCs
pid Process 2156 d18fc730b89f645e6ddb13c7c6d54041ac8b1d2a6677502ef792f8e74988e3d7.exe -
Loads dropped DLL 1 IoCs
pid Process 2188 d18fc730b89f645e6ddb13c7c6d54041ac8b1d2a6677502ef792f8e74988e3d7.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2156 d18fc730b89f645e6ddb13c7c6d54041ac8b1d2a6677502ef792f8e74988e3d7.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 2188 d18fc730b89f645e6ddb13c7c6d54041ac8b1d2a6677502ef792f8e74988e3d7.exe -
Suspicious use of UnmapMainImage 1 IoCs
pid Process 2156 d18fc730b89f645e6ddb13c7c6d54041ac8b1d2a6677502ef792f8e74988e3d7.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2188 wrote to memory of 2156 2188 d18fc730b89f645e6ddb13c7c6d54041ac8b1d2a6677502ef792f8e74988e3d7.exe 28 PID 2188 wrote to memory of 2156 2188 d18fc730b89f645e6ddb13c7c6d54041ac8b1d2a6677502ef792f8e74988e3d7.exe 28 PID 2188 wrote to memory of 2156 2188 d18fc730b89f645e6ddb13c7c6d54041ac8b1d2a6677502ef792f8e74988e3d7.exe 28 PID 2188 wrote to memory of 2156 2188 d18fc730b89f645e6ddb13c7c6d54041ac8b1d2a6677502ef792f8e74988e3d7.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\d18fc730b89f645e6ddb13c7c6d54041ac8b1d2a6677502ef792f8e74988e3d7.exe"C:\Users\Admin\AppData\Local\Temp\d18fc730b89f645e6ddb13c7c6d54041ac8b1d2a6677502ef792f8e74988e3d7.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2188 -
C:\Users\Admin\AppData\Local\Temp\d18fc730b89f645e6ddb13c7c6d54041ac8b1d2a6677502ef792f8e74988e3d7.exeC:\Users\Admin\AppData\Local\Temp\d18fc730b89f645e6ddb13c7c6d54041ac8b1d2a6677502ef792f8e74988e3d7.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of UnmapMainImage
PID:2156
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\d18fc730b89f645e6ddb13c7c6d54041ac8b1d2a6677502ef792f8e74988e3d7.exe
Filesize197KB
MD53045c08462dbe222cf275de9cd14b901
SHA1328915b80df634fd99e0c7e5467a0bef0152043d
SHA25634a231bd6eb22c833761a98cc618d571f6f3e6e092f4d7c9fc3a6ef7965df793
SHA5122d053a540ee289665942615e24eac1a19c2f86748760d13c8e75cd70a49e0a7be1d8d8712a5695fda8fcb4ef59b874cde1f3d4b5139efd083d7bce8c9d0119f8