Analysis
-
max time kernel
140s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
22-05-2024 20:33
Static task
static1
Behavioral task
behavioral1
Sample
392dc23f995f9f33326cd1c8d0d00acc362ab91b6ac2e01c2f9e4f8f7b55908e.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
392dc23f995f9f33326cd1c8d0d00acc362ab91b6ac2e01c2f9e4f8f7b55908e.exe
Resource
win10v2004-20240508-en
General
-
Target
392dc23f995f9f33326cd1c8d0d00acc362ab91b6ac2e01c2f9e4f8f7b55908e.exe
-
Size
1.9MB
-
MD5
4f008d96ed3655c232ca8590e8306d0a
-
SHA1
7d14f057bd4af7f5dc58c7292cec6d6b7ff41a87
-
SHA256
392dc23f995f9f33326cd1c8d0d00acc362ab91b6ac2e01c2f9e4f8f7b55908e
-
SHA512
2549d3d5c262b6adce00dbda839abe183c1fdb6bf76e1a76ef449700abe348d138988db36e809d82f1d6ee3f5cfd18d9e3d3d83a9f971e3015727d9435db8cf2
-
SSDEEP
49152:TaxJOOZ93b3ZmXYZmSadfqkbazR0vKLXZV:OSOHZmIZmSadfqoatuKLXZV
Malware Config
Signatures
-
Deletes itself 1 IoCs
Processes:
4AD4.tmppid process 3812 4AD4.tmp -
Executes dropped EXE 1 IoCs
Processes:
4AD4.tmppid process 3812 4AD4.tmp -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
392dc23f995f9f33326cd1c8d0d00acc362ab91b6ac2e01c2f9e4f8f7b55908e.exedescription pid process target process PID 3032 wrote to memory of 3812 3032 392dc23f995f9f33326cd1c8d0d00acc362ab91b6ac2e01c2f9e4f8f7b55908e.exe 4AD4.tmp PID 3032 wrote to memory of 3812 3032 392dc23f995f9f33326cd1c8d0d00acc362ab91b6ac2e01c2f9e4f8f7b55908e.exe 4AD4.tmp PID 3032 wrote to memory of 3812 3032 392dc23f995f9f33326cd1c8d0d00acc362ab91b6ac2e01c2f9e4f8f7b55908e.exe 4AD4.tmp
Processes
-
C:\Users\Admin\AppData\Local\Temp\392dc23f995f9f33326cd1c8d0d00acc362ab91b6ac2e01c2f9e4f8f7b55908e.exe"C:\Users\Admin\AppData\Local\Temp\392dc23f995f9f33326cd1c8d0d00acc362ab91b6ac2e01c2f9e4f8f7b55908e.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\4AD4.tmp"C:\Users\Admin\AppData\Local\Temp\4AD4.tmp"2⤵
- Deletes itself
- Executes dropped EXE
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\4AD4.tmpFilesize
1.9MB
MD5de1e5b8e2ef4a760870fa4b10dba7a47
SHA1bf0100f9d43274225a9c190856e8c73be32ccfc7
SHA25677b1090ef9bd170b9a5e037b42c2496a0443449b8f526b6486982cd818356759
SHA5122ae6f60321afbf2dbfeefc6e6ad7855865bd9d7c5f8d9394a9ed7db7256e95cf46bf91b1513c7ffeef0769d445ad2c2dab67a255eea85e2e14d1f352a878b753