Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
22-05-2024 23:03
Static task
static1
Behavioral task
behavioral1
Sample
7108d10defa60487c02dd986be4fca0eee5c3818bd5ee45edfd593de82e281be.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
7108d10defa60487c02dd986be4fca0eee5c3818bd5ee45edfd593de82e281be.exe
Resource
win10v2004-20240508-en
General
-
Target
7108d10defa60487c02dd986be4fca0eee5c3818bd5ee45edfd593de82e281be.exe
-
Size
79KB
-
MD5
0d93b9ef4f72a661b769cdefa13310fb
-
SHA1
65a28d518acc71d3cf0fba3103409cbd0fd4da54
-
SHA256
7108d10defa60487c02dd986be4fca0eee5c3818bd5ee45edfd593de82e281be
-
SHA512
afa262854c635aa9cad9a770257aac4694c01cb79d5e7de2c40a14ac7edc96459af204250371b4841d00a5e65fefdf930c4b82e68856d36d1f1593c37577bd0b
-
SSDEEP
1536:zvpoAj44j1TMVg8xOQA8AkqUhMb2nuy5wgIP0CSJ+5yLBB8GMGlZ5G:zvp+STMVNAGdqU7uy5w9WMyLBN5G
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
pid process 3972 [email protected] -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
7108d10defa60487c02dd986be4fca0eee5c3818bd5ee45edfd593de82e281be.execmd.exedescription pid process target process PID 3856 wrote to memory of 5076 3856 7108d10defa60487c02dd986be4fca0eee5c3818bd5ee45edfd593de82e281be.exe cmd.exe PID 3856 wrote to memory of 5076 3856 7108d10defa60487c02dd986be4fca0eee5c3818bd5ee45edfd593de82e281be.exe cmd.exe PID 3856 wrote to memory of 5076 3856 7108d10defa60487c02dd986be4fca0eee5c3818bd5ee45edfd593de82e281be.exe cmd.exe PID 5076 wrote to memory of 3972 5076 cmd.exe [email protected] PID 5076 wrote to memory of 3972 5076 cmd.exe [email protected] PID 5076 wrote to memory of 3972 5076 cmd.exe [email protected]
Processes
-
C:\Users\Admin\AppData\Local\Temp\7108d10defa60487c02dd986be4fca0eee5c3818bd5ee45edfd593de82e281be.exe"C:\Users\Admin\AppData\Local\Temp\7108d10defa60487c02dd986be4fca0eee5c3818bd5ee45edfd593de82e281be.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe
-
C:\Users\Admin\AppData\Local\Temp\[email protected]
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\[email protected]Filesize
79KB
MD5800b3ce472d76a518aa288be311f99f8
SHA11509dc87ebe45992fd02e90504d67a95841141e5
SHA256f78293b67d512a300e85d6324d315099217444fa7269277311db01b6bf2fce40
SHA51224c00980df59fb1fb1702b9904b20b011c822de1850b0ee7b4d426f3494af671efd97bcc8ecfc84997063225acb17956be6ac721aa078a55335e5fd0ad4f869c
-
memory/3856-6-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/3972-5-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB