Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
22-05-2024 21:36
Static task
static1
Behavioral task
behavioral1
Sample
505f747192ad4af8eb9f8f962283b0cf5dce0cf66f39f69e0642517aceac73ff.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
505f747192ad4af8eb9f8f962283b0cf5dce0cf66f39f69e0642517aceac73ff.exe
Resource
win10v2004-20240508-en
General
-
Target
505f747192ad4af8eb9f8f962283b0cf5dce0cf66f39f69e0642517aceac73ff.exe
-
Size
1.4MB
-
MD5
dd3945ecbe0f962c880ddf92f1906842
-
SHA1
bbe40c8cd651a44ecddc8d3499cd5601f143c821
-
SHA256
505f747192ad4af8eb9f8f962283b0cf5dce0cf66f39f69e0642517aceac73ff
-
SHA512
d8bd8be4ac2c2898afb1378719a22be04b92cf43fa2e90f11da2f8b037ba530728a5233409c5ceb9ac0ef762ace8a1270e2d34fe1a4bae39c3c07d526359dfd0
-
SSDEEP
24576:TaxIR5DC8dCQgOuHRMCaxiLZmN1DUZmSordfq6Ph2kkkkK4kXkkkkkkkkhLX3a2w:TaxIRhC8dCXOuHR7fZmXYZmSadfqkbax
Malware Config
Signatures
-
Deletes itself 1 IoCs
Processes:
EFE.tmppid process 2968 EFE.tmp -
Executes dropped EXE 1 IoCs
Processes:
EFE.tmppid process 2968 EFE.tmp -
Loads dropped DLL 1 IoCs
Processes:
505f747192ad4af8eb9f8f962283b0cf5dce0cf66f39f69e0642517aceac73ff.exepid process 2964 505f747192ad4af8eb9f8f962283b0cf5dce0cf66f39f69e0642517aceac73ff.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
505f747192ad4af8eb9f8f962283b0cf5dce0cf66f39f69e0642517aceac73ff.exedescription pid process target process PID 2964 wrote to memory of 2968 2964 505f747192ad4af8eb9f8f962283b0cf5dce0cf66f39f69e0642517aceac73ff.exe EFE.tmp PID 2964 wrote to memory of 2968 2964 505f747192ad4af8eb9f8f962283b0cf5dce0cf66f39f69e0642517aceac73ff.exe EFE.tmp PID 2964 wrote to memory of 2968 2964 505f747192ad4af8eb9f8f962283b0cf5dce0cf66f39f69e0642517aceac73ff.exe EFE.tmp PID 2964 wrote to memory of 2968 2964 505f747192ad4af8eb9f8f962283b0cf5dce0cf66f39f69e0642517aceac73ff.exe EFE.tmp
Processes
-
C:\Users\Admin\AppData\Local\Temp\505f747192ad4af8eb9f8f962283b0cf5dce0cf66f39f69e0642517aceac73ff.exe"C:\Users\Admin\AppData\Local\Temp\505f747192ad4af8eb9f8f962283b0cf5dce0cf66f39f69e0642517aceac73ff.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2964 -
C:\Users\Admin\AppData\Local\Temp\EFE.tmp"C:\Users\Admin\AppData\Local\Temp\EFE.tmp"2⤵
- Deletes itself
- Executes dropped EXE
PID:2968
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.4MB
MD5972838d35735fb332a31dc161488e3b3
SHA1ef91f7cfe40149dfc57c4bb974f41c9536d44b6f
SHA256d273d050797d3c505697d9a02c0e94970ed73b7dc4b36b0d77b52c16095853b4
SHA5122b112a3a75917c94c10a3ee42f3c10f82cd67505663f62fd927506e3493d66833fb3287719015b435fcfffdf6377be4684d490dd7c48b2ae9f3d180343ece4d7