Analysis
-
max time kernel
117s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
22-05-2024 20:38
Static task
static1
Behavioral task
behavioral1
Sample
3aad7b73f6dc761f7ebb5e56e70503ca0d1f682df9ffe085d75f4feb3e40e889.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
3aad7b73f6dc761f7ebb5e56e70503ca0d1f682df9ffe085d75f4feb3e40e889.exe
Resource
win10v2004-20240226-en
General
-
Target
3aad7b73f6dc761f7ebb5e56e70503ca0d1f682df9ffe085d75f4feb3e40e889.exe
-
Size
720KB
-
MD5
fc0b6d3bf31be46f7d8211c234ec2672
-
SHA1
be84abaaea55263dd90d923c26d235eec475a336
-
SHA256
3aad7b73f6dc761f7ebb5e56e70503ca0d1f682df9ffe085d75f4feb3e40e889
-
SHA512
858a07223d71dcda427c3dacfc86ded49c80fb976d6899caa9c4f2740cbc2f74143e4e884a6aa8ed505f507d21b905b2c776ca495333b1e4148619e858fc08b8
-
SSDEEP
12288:QhJbM4euy6D9d9pA6etej3uC+IOJ5D9d9pAn:8LygZKnJp4
Malware Config
Signatures
-
Deletes itself 1 IoCs
Processes:
3aad7b73f6dc761f7ebb5e56e70503ca0d1f682df9ffe085d75f4feb3e40e889.exepid process 1984 3aad7b73f6dc761f7ebb5e56e70503ca0d1f682df9ffe085d75f4feb3e40e889.exe -
Executes dropped EXE 1 IoCs
Processes:
3aad7b73f6dc761f7ebb5e56e70503ca0d1f682df9ffe085d75f4feb3e40e889.exepid process 1984 3aad7b73f6dc761f7ebb5e56e70503ca0d1f682df9ffe085d75f4feb3e40e889.exe -
Loads dropped DLL 1 IoCs
Processes:
3aad7b73f6dc761f7ebb5e56e70503ca0d1f682df9ffe085d75f4feb3e40e889.exepid process 3024 3aad7b73f6dc761f7ebb5e56e70503ca0d1f682df9ffe085d75f4feb3e40e889.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
3aad7b73f6dc761f7ebb5e56e70503ca0d1f682df9ffe085d75f4feb3e40e889.exepid process 1984 3aad7b73f6dc761f7ebb5e56e70503ca0d1f682df9ffe085d75f4feb3e40e889.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
3aad7b73f6dc761f7ebb5e56e70503ca0d1f682df9ffe085d75f4feb3e40e889.exepid process 3024 3aad7b73f6dc761f7ebb5e56e70503ca0d1f682df9ffe085d75f4feb3e40e889.exe -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
3aad7b73f6dc761f7ebb5e56e70503ca0d1f682df9ffe085d75f4feb3e40e889.exepid process 1984 3aad7b73f6dc761f7ebb5e56e70503ca0d1f682df9ffe085d75f4feb3e40e889.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
3aad7b73f6dc761f7ebb5e56e70503ca0d1f682df9ffe085d75f4feb3e40e889.exedescription pid process target process PID 3024 wrote to memory of 1984 3024 3aad7b73f6dc761f7ebb5e56e70503ca0d1f682df9ffe085d75f4feb3e40e889.exe 3aad7b73f6dc761f7ebb5e56e70503ca0d1f682df9ffe085d75f4feb3e40e889.exe PID 3024 wrote to memory of 1984 3024 3aad7b73f6dc761f7ebb5e56e70503ca0d1f682df9ffe085d75f4feb3e40e889.exe 3aad7b73f6dc761f7ebb5e56e70503ca0d1f682df9ffe085d75f4feb3e40e889.exe PID 3024 wrote to memory of 1984 3024 3aad7b73f6dc761f7ebb5e56e70503ca0d1f682df9ffe085d75f4feb3e40e889.exe 3aad7b73f6dc761f7ebb5e56e70503ca0d1f682df9ffe085d75f4feb3e40e889.exe PID 3024 wrote to memory of 1984 3024 3aad7b73f6dc761f7ebb5e56e70503ca0d1f682df9ffe085d75f4feb3e40e889.exe 3aad7b73f6dc761f7ebb5e56e70503ca0d1f682df9ffe085d75f4feb3e40e889.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3aad7b73f6dc761f7ebb5e56e70503ca0d1f682df9ffe085d75f4feb3e40e889.exe"C:\Users\Admin\AppData\Local\Temp\3aad7b73f6dc761f7ebb5e56e70503ca0d1f682df9ffe085d75f4feb3e40e889.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:3024 -
C:\Users\Admin\AppData\Local\Temp\3aad7b73f6dc761f7ebb5e56e70503ca0d1f682df9ffe085d75f4feb3e40e889.exeC:\Users\Admin\AppData\Local\Temp\3aad7b73f6dc761f7ebb5e56e70503ca0d1f682df9ffe085d75f4feb3e40e889.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of UnmapMainImage
PID:1984
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\3aad7b73f6dc761f7ebb5e56e70503ca0d1f682df9ffe085d75f4feb3e40e889.exe
Filesize720KB
MD52f84df78cf141e3efcd46524186ded40
SHA1c4a0b1a3ea6b07ec095c46abd65ac1a03acc43a9
SHA25608f9a80e9399f63e4b0b2a33187f6b09e5088b03c19923567157169342356da2
SHA512928b42b592a20063609268179c81ecadb0aa2a135b5154a7b96b167c042f1378267595d7c3fd9b503f97330dfdddb5693cb7c4b6c1bc4e36bbf7b34b2a0d8810