Analysis
- max time kernel
121s - max time network
126s - platform
windows7_x64 - resource
win7-20240220-en - resource tags
- submitted
20/05/2024, 06:56
General
- Target 125/125.exe
- Size 18.3MB
- Sample240520-hqdlmsgf63
- SHA256 5a54cda9e42baea3defa9f1024858f7c44f79242b8765c9e886a8f54db6e1934
Malware Config
Signatures
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\125\125.exe"C:\Users\Admin\AppData\Local\Temp\125\125.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\125\Addons\bin\javaw.exe"C:\Users\Admin\AppData\Local\Temp\125\Addons\bin\javaw.exe" -version2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\125\Addons\bin\javaw.exe"C:\Users\Admin\AppData\Local\Temp\125\Addons\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Local\Temp\125\125.exe"2⤵
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1248-38-0x0000000000400000-0x000000000041E000-memory.dmp
memory/1312-5-0x0000000002630000-0x0000000002658000-memory.dmp
memory/1312-9-0x0000000002678000-0x0000000002680000-memory.dmp
memory/1312-12-0x0000000002680000-0x0000000002688000-memory.dmp
memory/1312-27-0x00000000026D0000-0x00000000026D8000-memory.dmp
memory/1312-26-0x0000000002668000-0x0000000002670000-memory.dmp
memory/1312-25-0x00000000026C8000-0x00000000026D0000-memory.dmp
memory/1312-32-0x0000000000190000-0x0000000000191000-memory.dmp
memory/1312-34-0x0000000002630000-0x0000000002658000-memory.dmp
memory/1312-37-0x00000000026D0000-0x00000000026D8000-memory.dmp
memory/1312-36-0x0000000002680000-0x0000000002688000-memory.dmp
memory/1312-35-0x0000000002678000-0x0000000002680000-memory.dmp
memory/1312-33-0x0000000002670000-0x0000000002678000-memory.dmp
memory/2784-44-0x0000000002780000-0x00000000027A8000-memory.dmp
memory/2784-48-0x00000000027C8000-0x00000000027D0000-memory.dmp
memory/2784-51-0x00000000027D0000-0x00000000027D8000-memory.dmp
memory/2784-71-0x00000000027C0000-0x00000000027C8000-memory.dmp
memory/2784-70-0x0000000002820000-0x0000000002828000-memory.dmp
memory/2784-69-0x00000000027B8000-0x00000000027C0000-memory.dmp
memory/2784-65-0x0000000002818000-0x0000000002820000-memory.dmp
memory/2784-73-0x0000000002828000-0x0000000002830000-memory.dmp
memory/2784-75-0x0000000002830000-0x0000000002838000-memory.dmp
memory/2784-77-0x0000000002838000-0x0000000002840000-memory.dmp
memory/2784-79-0x0000000002840000-0x0000000002848000-memory.dmp
memory/2784-80-0x00000000001C0000-0x00000000001C1000-memory.dmp
memory/2784-82-0x0000000002848000-0x0000000002850000-memory.dmp
memory/2784-86-0x0000000002780000-0x00000000027A8000-memory.dmp
memory/2784-87-0x0000000002850000-0x0000000002858000-memory.dmp
memory/2784-90-0x0000000002858000-0x0000000002860000-memory.dmp
memory/2784-89-0x00000000027C8000-0x00000000027D0000-memory.dmp
memory/2784-94-0x0000000002860000-0x0000000002868000-memory.dmp
memory/2784-93-0x00000000027D0000-0x00000000027D8000-memory.dmp
memory/2784-97-0x0000000002818000-0x0000000002820000-memory.dmp
memory/2784-98-0x0000000002868000-0x0000000002870000-memory.dmp
memory/2784-100-0x00000000027B8000-0x00000000027C0000-memory.dmp
memory/2784-101-0x0000000002820000-0x0000000002828000-memory.dmp
memory/2784-102-0x0000000002870000-0x0000000002878000-memory.dmp
memory/2784-106-0x00000000027D0000-0x00000000027D8000-memory.dmp
memory/2784-107-0x0000000002818000-0x0000000002820000-memory.dmp
memory/2784-108-0x00000000027B8000-0x00000000027C0000-memory.dmp
memory/2784-109-0x0000000002820000-0x0000000002828000-memory.dmp
memory/2784-110-0x0000000002828000-0x0000000002830000-memory.dmp
memory/2784-111-0x0000000002830000-0x0000000002838000-memory.dmp
memory/2784-112-0x0000000002838000-0x0000000002840000-memory.dmp
memory/2784-113-0x0000000002840000-0x0000000002848000-memory.dmp
memory/2784-114-0x0000000002848000-0x0000000002850000-memory.dmp
memory/2784-115-0x0000000002850000-0x0000000002858000-memory.dmp
memory/2784-116-0x0000000002858000-0x0000000002860000-memory.dmp
memory/2784-117-0x0000000002860000-0x0000000002868000-memory.dmp
memory/2784-118-0x0000000002868000-0x0000000002870000-memory.dmp
memory/2784-119-0x0000000002870000-0x0000000002878000-memory.dmp