Overview

overview

7

Static

static

3

46b339db97...eb.exe

windows7-x64

7

46b339db97...eb.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240215-en
  • resource tags

    arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
  • submitted
    28-05-2024 21:01

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    46b339db976836716554467f4f416368f4e11ba0f4b9ebe2673da20a9568f6eb.exe

  • Size

    66KB

  • MD5

    0100329c480085c80165fb680a087043

  • SHA1

    6b089166dacb9b61e759c7dfe7bdf947eb8d2160

  • SHA256

    46b339db976836716554467f4f416368f4e11ba0f4b9ebe2673da20a9568f6eb

  • SHA512

    501fc369b0aafe7542266e3ba6e84014f2f082fde7b91ad834464ada07c65c2d4bcd02b157c33e5240d522cf9fc4703321d03f4b48b470129c371a2c20d64206

  • SSDEEP

    768:iLxqBt1sJw5pVNUP1/kvtbWcpmCKXHak3QIXjLZJ2bXfqQKMq+gjTAfu/MB8QKpi:1teqYQIXJJyXEv/MBK6vRel1ewE

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 3 IoCs
  • Drops file in System32 directory 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\46b339db976836716554467f4f416368f4e11ba0f4b9ebe2673da20a9568f6eb.exe
    "C:\Users\Admin\AppData\Local\Temp\46b339db976836716554467f4f416368f4e11ba0f4b9ebe2673da20a9568f6eb.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    • Suspicious use of WriteProcessMemory
    PID:1732
    • C:\Windows\SysWOW64\ounloaxanú±¬±
      "C:\Windows\system32\ounloaxanú±¬±"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in System32 directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2888
      • C:\Windows\SysWOW64\ounloaxanú±¬±
        ùù¿çç¤
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        PID:3036

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\SysWOW64\orxoagar-idoabú°¸¸
    Filesize

    5KB

    MD5

    48c45e05569f9a5665d082fbdc116c14

    SHA1

    e491ab1327b88312fc6d0535621b6de733c8efb5

    SHA256

    7e916f847bb5de3e09b36bd527e09ed656df13296bdcd9924185bcccde7dbe4c

    SHA512

    e1cc47e185831dc6c40372efc227f299964f262c641b790d31f0fe452a5bc70a4946c689913504c64790833c131d40c01fcd9ff3a148636be9f502959f7cc49c

    Download Submit

  • \Windows\SysWOW64\ounloaxanú±¬±
    Filesize

    66KB

    MD5

    6d967c763e1daa1617210e4b070e18b9

    SHA1

    00e8a2a0ca60f6e1a4dbb9424f6f54d5958fc1f8

    SHA256

    8cf092ad0d07082cc9f7b46d2a7e2ad35c82a70abfd65016ea350b3e0500e958

    SHA512

    e599fdcf5b85ad4d8c6867ad774bf1a4bc413f56e3ef9464884442bd02e80f8bf9d6e9b8f6b4103ee8797586c41667a73967edbbaa3eb11d5f72b48155c21f5a

    Download Submit

  • memory/1732-10-0x0000000000400000-0x0000000000414000-memory.dmp

    Filesize

    80KB

    Download

  • memory/2888-29-0x0000000000400000-0x0000000000414000-memory.dmp

    Filesize

    80KB

    Download

  • memory/3036-30-0x0000000000400000-0x0000000000414000-memory.dmp

    Filesize

    80KB

    Download