Analysis
-
max time kernel
122s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
23-05-2024 18:29
Static task
static1
Behavioral task
behavioral1
Sample
0a8e7b1a2be3de93da939c4d04d69b1ce9629115fde08f8cfdcbc06324085da2.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
0a8e7b1a2be3de93da939c4d04d69b1ce9629115fde08f8cfdcbc06324085da2.exe
Resource
win10v2004-20240426-en
General
-
Target
0a8e7b1a2be3de93da939c4d04d69b1ce9629115fde08f8cfdcbc06324085da2.exe
-
Size
5.4MB
-
MD5
24c677ceb21297350b8df7e5b3bb8354
-
SHA1
58dcf0a60ad7cf2496b6b6a9e194176f2b0fb737
-
SHA256
0a8e7b1a2be3de93da939c4d04d69b1ce9629115fde08f8cfdcbc06324085da2
-
SHA512
d5b87f1305573e6872524c1738a9ada25d6286caa9f40cddffb391ce69f49bd961c0e95aaae77bd5b29508a3007c2418b9e1ed01f5b2c88b780e8331e64f2f31
-
SSDEEP
98304:emhd1UryeuNhchxN7V7wQqZUha5jtSyZIUh:elIcrJ2QbaZtliU
Malware Config
Signatures
-
Deletes itself 1 IoCs
Processes:
691F.tmppid process 2780 691F.tmp -
Executes dropped EXE 1 IoCs
Processes:
691F.tmppid process 2780 691F.tmp -
Loads dropped DLL 2 IoCs
Processes:
0a8e7b1a2be3de93da939c4d04d69b1ce9629115fde08f8cfdcbc06324085da2.exepid process 2208 0a8e7b1a2be3de93da939c4d04d69b1ce9629115fde08f8cfdcbc06324085da2.exe 2208 0a8e7b1a2be3de93da939c4d04d69b1ce9629115fde08f8cfdcbc06324085da2.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
0a8e7b1a2be3de93da939c4d04d69b1ce9629115fde08f8cfdcbc06324085da2.exedescription pid process target process PID 2208 wrote to memory of 2780 2208 0a8e7b1a2be3de93da939c4d04d69b1ce9629115fde08f8cfdcbc06324085da2.exe 691F.tmp PID 2208 wrote to memory of 2780 2208 0a8e7b1a2be3de93da939c4d04d69b1ce9629115fde08f8cfdcbc06324085da2.exe 691F.tmp PID 2208 wrote to memory of 2780 2208 0a8e7b1a2be3de93da939c4d04d69b1ce9629115fde08f8cfdcbc06324085da2.exe 691F.tmp PID 2208 wrote to memory of 2780 2208 0a8e7b1a2be3de93da939c4d04d69b1ce9629115fde08f8cfdcbc06324085da2.exe 691F.tmp
Processes
-
C:\Users\Admin\AppData\Local\Temp\0a8e7b1a2be3de93da939c4d04d69b1ce9629115fde08f8cfdcbc06324085da2.exe"C:\Users\Admin\AppData\Local\Temp\0a8e7b1a2be3de93da939c4d04d69b1ce9629115fde08f8cfdcbc06324085da2.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\691F.tmp"C:\Users\Admin\AppData\Local\Temp\691F.tmp" --splashC:\Users\Admin\AppData\Local\Temp\0a8e7b1a2be3de93da939c4d04d69b1ce9629115fde08f8cfdcbc06324085da2.exe 7B8C366B32CF35D82E2A38E5067DD1AFE1D01CB3C45779339E91E326C927582B65FE23CFDFBF8EC2370D5328CF95B7109F9C6BD2E3AEAE38BB2B66C5358836D22⤵
- Deletes itself
- Executes dropped EXE
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\691F.tmpFilesize
5.4MB
MD53f5525f2a96139efbb247048d99c7c7f
SHA1e78072b8d48236f44801552669945ea2b2e995e0
SHA256e5529154cc84d3f13a7469c531f61430ddabd5ed2be49e725961b8fd8f981e72
SHA512e541ac59b2623baebea7209a5a96ee5f6c5178e65c1a25a724854c84855841e16ed7e7c8ebcb006601c8648366c1ba55afb4df149905387d86b597b98e93d196
-
memory/2208-0-0x0000000000400000-0x0000000000849000-memory.dmpFilesize
4.3MB
-
memory/2780-9-0x0000000000400000-0x0000000000849000-memory.dmpFilesize
4.3MB