Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
05/05/2024, 14:17
General
-
Target
5a5f1e9a042d60b789b9dd0c8414aafa27c2d29f7ba4e55ca7d386985de18409.exe
-
Size
816KB
-
MD5
23b16adc2dadc4bc4607118b91e4e330
-
SHA1
7cb1a0a75a12be550f0aef4ca989e65062d0df6d
-
SHA256
5a5f1e9a042d60b789b9dd0c8414aafa27c2d29f7ba4e55ca7d386985de18409
-
SHA512
6170d772217a41fdcb4e560967e7bc999b80b3fdacd1266417d605be253dc8b6772763ca5e7ff952e3e0ef64a3065a761fea0bd7920e1cf99b5167891f62372b
-
SSDEEP
24576:2Y4G2qLMJalsnqShyoo77lUabuSvbDQOOdIxJsG9O:X3XZynV4oDabuWbDQOcIxJJ9O
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\5a5f1e9a042d60b789b9dd0c8414aafa27c2d29f7ba4e55ca7d386985de18409.exe"C:\Users\Admin\AppData\Local\Temp\5a5f1e9a042d60b789b9dd0c8414aafa27c2d29f7ba4e55ca7d386985de18409.exe"1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1A0A0B0B120C156E155A15A0A0D160D0F160F.exeC:\Users\Admin\AppData\Local\Temp\1A0A0B0B120C156E155A15A0A0D160D0F160F.exe2⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
816KB
MD5f0a0425fecf9ae6982f329133e922527
SHA130ac4db477597e0b19c34c4194eda6a478920ea1
SHA2569c4b79fd309a5c3511b85c3de3c10f4f0f3ab79c75ccdd4dfd66237bd06cdbfc
SHA512d982a0043bfc03b639976b3a090ea82a3e2598164c64b43a93f1923ea264b6356e6b8b7b4cb76c7c312991dd4729414d9ea5096bae9a16da4b8994d684ec36a7
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
120KB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB