Overview

overview

7

Static

static

3

94f34dfefd...aa.exe

windows7-x64

7

94f34dfefd...aa.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    118s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240419-en
  • resource tags

    arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
  • submitted
    05/06/2024, 00:40

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    94f34dfefdb0bd40a916355b886edc85f90076ee9239a9e9097e0f4c1a8649aa.exe

  • Size

    320KB

  • MD5

    1506a39bb0aaf3e201e2893ec08f2c3f

  • SHA1

    74e2185bbb70b00162aa7499b87125ec3b81243a

  • SHA256

    94f34dfefdb0bd40a916355b886edc85f90076ee9239a9e9097e0f4c1a8649aa

  • SHA512

    90e0e4c58939748e539ee7a461e104b585e07389f1d110481517eb38a2c1139fe05afbe12a921384511da4762f28fb69c50a412f99d8741bc73293a1801d56fc

  • SSDEEP

    6144:sKyXnRl7XdvPNQOSPb3Y3Xd8GVwMr6UwGU6qG1B7qV40saiigCDN:s5bdvPNFSPb3sXd8GVwMmUwGU6qG1Bmx

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\94f34dfefdb0bd40a916355b886edc85f90076ee9239a9e9097e0f4c1a8649aa.exe
    "C:\Users\Admin\AppData\Local\Temp\94f34dfefdb0bd40a916355b886edc85f90076ee9239a9e9097e0f4c1a8649aa.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: RenamesItself
    • Suspicious use of WriteProcessMemory
    PID:3012
    • C:\Users\Admin\AppData\Local\Temp\94f34dfefdb0bd40a916355b886edc85f90076ee9239a9e9097e0f4c1a8649aa.exe
      C:\Users\Admin\AppData\Local\Temp\94f34dfefdb0bd40a916355b886edc85f90076ee9239a9e9097e0f4c1a8649aa.exe
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Suspicious use of UnmapMainImage
      PID:2968

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • \Users\Admin\AppData\Local\Temp\94f34dfefdb0bd40a916355b886edc85f90076ee9239a9e9097e0f4c1a8649aa.exe
          Filesize

          320KB

          MD5

          24953eaf5cc6435c9fbeccb1621c6094

          SHA1

          c9eb3eacdc5a739b438f188f1ee4692e84e9ef69

          SHA256

          6058749a71b645d948fdd079da7b6006a9c2072056d98aee1ae7582757027caf

          SHA512

          a57074d7680f34e07ebbf0fad475d195b5f8c1ca91544845a4c0d243a34204ba8a1057fb673ad4944bb3e1df66859c9980cab542b08aa258009c9fd597c2df31

          Download Submit

        • memory/2968-16-0x0000000000130000-0x000000000016F000-memory.dmp

          Filesize

          252KB

          Download

        • memory/2968-12-0x0000000000400000-0x000000000041A000-memory.dmp

          Filesize

          104KB

          Download

        • memory/2968-10-0x0000000000400000-0x000000000043F000-memory.dmp

          Filesize

          252KB

          Download

        • memory/3012-0-0x0000000000400000-0x000000000043F000-memory.dmp

          Filesize

          252KB

          Download

        • memory/3012-9-0x0000000000400000-0x000000000043F000-memory.dmp

          Filesize

          252KB

          Download