Analysis
-
max time kernel
119s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
02/06/2024, 03:09
General
-
Target
d28f6bd8f8b992f1cdc1369347821ea51630621d6cac34401a32bd8c8f3d3c79.exe
-
Size
6.0MB
-
MD5
2901d6b003669c0719adbc2df864595e
-
SHA1
210e5e08ccf5918abe897b1438ae528cdfcbdd0e
-
SHA256
d28f6bd8f8b992f1cdc1369347821ea51630621d6cac34401a32bd8c8f3d3c79
-
SHA512
3775f06e4211ba2576725ff9011c2a3d38bc74ca22b53f2478c6e79ce4134c73fa2818ea5a79b4a8b4769c7189e4dda78b2429513d439e11fa92e7a36d870bb5
-
SSDEEP
98304:emhd1Urye9pi1Df+j0vM9aLKPV7wQqZUha5jtSyZIUS:elSvVLKP2QbaZtlir
Score
7/10
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d28f6bd8f8b992f1cdc1369347821ea51630621d6cac34401a32bd8c8f3d3c79.exe"C:\Users\Admin\AppData\Local\Temp\d28f6bd8f8b992f1cdc1369347821ea51630621d6cac34401a32bd8c8f3d3c79.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\140D.tmp"C:\Users\Admin\AppData\Local\Temp\140D.tmp" --splashC:\Users\Admin\AppData\Local\Temp\d28f6bd8f8b992f1cdc1369347821ea51630621d6cac34401a32bd8c8f3d3c79.exe BCA8F3DC2F24CCB0E59A696590ED67B000C5267B214F3B3245ABD38C9D8F2B2AF134D047CE939D7DD7A5A5F994FCCA16E81050AFB0D056560A71C291510847CD2⤵
- Deletes itself
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
6.0MB
MD58c5c31aae7c1b5039cd07f03ef7fa5e0
SHA1d25406fb2112576c8581cc4c4ceaf9ee5d7d56ca
SHA25681c1ee522b55e2b6f190b27a29d96c84f06fb53017b8cea83c65680ef3dbb24b
SHA512848e0ef8c1fe20624987e59fa58be8647b30da8cf54b327c64bf2b91e74701812f6b3c38b090a5a96b73c5eb40e2e035de979be1494d3675400d234e42385307
-
Filesize
4.3MB
-
Filesize
4.3MB