Analysis
-
max time kernel
117s -
max time network
117s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
03-05-2024 02:24
General
-
Target
b1205aa10a7e51359e1cc6cb44d7b292bbfc5f2373c1a53870858714584767f9.exe
-
Size
700KB
-
MD5
a45c1da75f98708dc3bad91bf9a409e6
-
SHA1
0f89aa6463a483c4826698cacec87396d90279a5
-
SHA256
b1205aa10a7e51359e1cc6cb44d7b292bbfc5f2373c1a53870858714584767f9
-
SHA512
ed521e36373a05775a59d3170039cfdaf002aaa5beac8bf60b6de28e3c2e00e5691ef8e41b33acb57d38a3b0fd95e5ff5d30ce0d1170d52a29a7120225f747e8
-
SSDEEP
12288:iWBm+95nHfF2mgewFx5yxfOD+Vm6JVGo1kfgjdkAitv4aHlrc+6LAEOJ4tdmHQjZ:iWBz95ndbgfx5yZOiVmIV8gjTitv4aH+
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b1205aa10a7e51359e1cc6cb44d7b292bbfc5f2373c1a53870858714584767f9.exe"C:\Users\Admin\AppData\Local\Temp\b1205aa10a7e51359e1cc6cb44d7b292bbfc5f2373c1a53870858714584767f9.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\19F6.tmp"C:\Users\Admin\AppData\Local\Temp\19F6.tmp" --pingC:\Users\Admin\AppData\Local\Temp\b1205aa10a7e51359e1cc6cb44d7b292bbfc5f2373c1a53870858714584767f9.exe A075E7DC958D662F5D35BDB621B08D5BA053C220F5CD62619D16C9C25C4D9A91636F705F29E83F72BB3FFB2A44CA8F818E99823A26B951C14E5E857D267795B12⤵
- Deletes itself
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
700KB
MD511e7e87b650115160a6a01fff30947ca
SHA1a77568b700724ba40bf98513086c8c697faf2e1d
SHA256ce37210973ad9e65d9018da102e1ec601ad3a1289ef9f2c5c7599b27ab4571bf
SHA512bbff654b8df96f3a4cf9f0e894684c25d68913e21ba0eef51a582779d625c1f132bd3eb2b98a7f916f6a18b36e65abad0a583199bc4f22ca0c560479bfd0240f
-
Filesize
540KB
-
Filesize
540KB
-
Filesize
540KB
-
Filesize
540KB