Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
29/05/2024, 11:36
Behavioral task
behavioral1
Sample
05c1560bfbedbe9569d2dbf38790d96cc167c769a5057c3184f64afbf8333fd2.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
05c1560bfbedbe9569d2dbf38790d96cc167c769a5057c3184f64afbf8333fd2.exe
Resource
win10v2004-20240426-en
General
-
Target
05c1560bfbedbe9569d2dbf38790d96cc167c769a5057c3184f64afbf8333fd2.exe
-
Size
5.7MB
-
MD5
f0e2a9b080339c58378a55444868b766
-
SHA1
5e4ac6b91bcffc2d7b62be0148b53b32875a01f3
-
SHA256
05c1560bfbedbe9569d2dbf38790d96cc167c769a5057c3184f64afbf8333fd2
-
SHA512
e01e3bc19f7da76537bab04089d69cb7938f1389634e7bfe70ab748ab22991fde8b712e310efc42df8ab64e0da83d2046625e7ca3bb13dbb3ed089c616552e40
-
SSDEEP
98304:ljpRtF5kcwoPllMWHubXkTZONq0d6NlPf9/iPUGyFFFYIcgaNCSsRCfT:7moP1HOXfZ8bntiBsFFYIcHCSsw
Malware Config
Signatures
-
Loads dropped DLL 3 IoCs
pid Process 2808 05c1560bfbedbe9569d2dbf38790d96cc167c769a5057c3184f64afbf8333fd2.exe 2808 05c1560bfbedbe9569d2dbf38790d96cc167c769a5057c3184f64afbf8333fd2.exe 2808 05c1560bfbedbe9569d2dbf38790d96cc167c769a5057c3184f64afbf8333fd2.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: 35 2808 05c1560bfbedbe9569d2dbf38790d96cc167c769a5057c3184f64afbf8333fd2.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2036 wrote to memory of 2808 2036 05c1560bfbedbe9569d2dbf38790d96cc167c769a5057c3184f64afbf8333fd2.exe 28 PID 2036 wrote to memory of 2808 2036 05c1560bfbedbe9569d2dbf38790d96cc167c769a5057c3184f64afbf8333fd2.exe 28 PID 2036 wrote to memory of 2808 2036 05c1560bfbedbe9569d2dbf38790d96cc167c769a5057c3184f64afbf8333fd2.exe 28 PID 2036 wrote to memory of 2808 2036 05c1560bfbedbe9569d2dbf38790d96cc167c769a5057c3184f64afbf8333fd2.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\05c1560bfbedbe9569d2dbf38790d96cc167c769a5057c3184f64afbf8333fd2.exe"C:\Users\Admin\AppData\Local\Temp\05c1560bfbedbe9569d2dbf38790d96cc167c769a5057c3184f64afbf8333fd2.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2036 -
C:\Users\Admin\AppData\Local\Temp\05c1560bfbedbe9569d2dbf38790d96cc167c769a5057c3184f64afbf8333fd2.exe"C:\Users\Admin\AppData\Local\Temp\05c1560bfbedbe9569d2dbf38790d96cc167c769a5057c3184f64afbf8333fd2.exe"2⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:2808
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5c45ceb39869647b4dfb14c93837a9c4e
SHA1f8405099a4b6f6d2994e19ec79e5dee27476d45b
SHA256ad05c3f3250c6331d05fb023ac760b6903f2105533ed5fa557a8bf986bfe0fa4
SHA5123db3f0d47be2485035d343d017f7c9b6e3786fb1ef7eae3234c2a215b218185f6b61fa17b75d8a1f6a33c0644871e4087b5a2ee192b99979e73def4600029553
-
Filesize
81KB
MD5aeab74db6bc6c914997f1a8a9ff013ec
SHA16b717f23227d158d6aa566498c438b8f305a29b5
SHA25618ccb2dd8af853f4e6221bb5513e3154ef67ae61cee6ec319a8a97615987dc4b
SHA512a2832b7720599361e2537f79a2597acb1a2d5633fdfe20a0d1075e9457683fdb1d5676d121c0bf1a825ff99512dcd924254f1151b50aae922acc0cc10f461036
-
Filesize
102KB
MD510861d3fa19d7dc3b41eb6f837340782
SHA1b258d223b444ab994ec2fec95acaa9f82dc3938c
SHA2566255bab0b7f3e2209a9c8b89a3e1ec1bbc7a29849a18e70c0cf582a63c90bed1
SHA512ec83134c9bce9cedeee8ebdb8e382fb7f944a7bc9d3bb47c7e3144ef2ef95114a36ac1cc8c0d52f434ee4c359d938a2d7c035e699c4407df728e200de7da4af9
-
Filesize
763KB
MD5b832d0341e7ee9cca8c3876e0d2b3a6c
SHA19428352a483bd1f024bfbb787daa78de73729951
SHA256b45fd442005c89134f2c876a22534166568210cbfc15e5bc1bfe94865eab85ff
SHA512c4fbed156d6c9a2d3d776d1e22b84afc7c360f3a80bddef50dc4afe05d226ceca931a37be3a83ff78025c247046783380ef4a23f4f0fca2c9a75d91d18c83cd3
-
Filesize
3.3MB
MD5465089eaced8159ec533e4a37033e227
SHA1074596adae6f53f33b8297f02e21f6a6f7ac6ff1
SHA2562b29ae140cb9f08af872acf9e17f785ef99398ef3367549b55242bc064d6ae40
SHA51255eca0922074162c22fff2b4f97bd2972540fa893b9b02b7d9bfa26345186dbbdaf1fbc37a9eba6366743d0d42fb5bb88e708877dfd57cb02ca4d3a6953cfb81