Analysis
-
max time kernel
139s -
max time network
103s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
21-05-2024 20:51
Static task
static1
Behavioral task
behavioral1
Sample
32716eddcaf9d407a567314da1ceed5666bbe81569a8324cd74bb7d0add02e90.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
32716eddcaf9d407a567314da1ceed5666bbe81569a8324cd74bb7d0add02e90.exe
Resource
win10v2004-20240508-en
General
-
Target
32716eddcaf9d407a567314da1ceed5666bbe81569a8324cd74bb7d0add02e90.exe
-
Size
79KB
-
MD5
48510b0487ed8a293f912ac0a502d585
-
SHA1
6612a967f9152d102d64d0e8407aac3b6f66f17c
-
SHA256
32716eddcaf9d407a567314da1ceed5666bbe81569a8324cd74bb7d0add02e90
-
SHA512
eeb00d26fc53576a9c384bb74d0abae471e323995d616ca2a5240ecbbe2fc56f57d9da4b413a75813646204aca1c715efefaf15ef2d5d7750151b64f3abadc50
-
SSDEEP
1536:zvwmwwGfvoYmS3uOQA8AkqUhMb2nuy5wgIP0CSJ+5y0SB8GMGlZ5G:zvRcQYpGdqU7uy5w9WMyhN5G
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
pid process 4844 [email protected] -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
32716eddcaf9d407a567314da1ceed5666bbe81569a8324cd74bb7d0add02e90.execmd.exedescription pid process target process PID 468 wrote to memory of 4932 468 32716eddcaf9d407a567314da1ceed5666bbe81569a8324cd74bb7d0add02e90.exe cmd.exe PID 468 wrote to memory of 4932 468 32716eddcaf9d407a567314da1ceed5666bbe81569a8324cd74bb7d0add02e90.exe cmd.exe PID 468 wrote to memory of 4932 468 32716eddcaf9d407a567314da1ceed5666bbe81569a8324cd74bb7d0add02e90.exe cmd.exe PID 4932 wrote to memory of 4844 4932 cmd.exe [email protected] PID 4932 wrote to memory of 4844 4932 cmd.exe [email protected] PID 4932 wrote to memory of 4844 4932 cmd.exe [email protected]
Processes
-
C:\Users\Admin\AppData\Local\Temp\32716eddcaf9d407a567314da1ceed5666bbe81569a8324cd74bb7d0add02e90.exe"C:\Users\Admin\AppData\Local\Temp\32716eddcaf9d407a567314da1ceed5666bbe81569a8324cd74bb7d0add02e90.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe
-
C:\Users\Admin\AppData\Local\Temp\[email protected]
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\[email protected]Filesize
79KB
MD59885cb53ca0d39d6c4a8c10c221ba02a
SHA11e71c071a3307913823f4b50053b8b0f38fae7db
SHA256bbba65c7a23c15eddabb276f53ddf38af21ecc02bf13dd4c95dd149303957f82
SHA512db89f69e19c73c538d04b683eda170abd5eff41eea7c11b73fe59e0e476f973c5db2c72f7d47bab84e5b097bc28015a9502ca34c1e6f54bd981411004d33053d
-
memory/468-6-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/4844-5-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB