Analysis
- max time kernel
141s - max time network
101s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
05/06/2024, 04:40
Behavioral task
behavioral1
Sample
e4f63c24e7615203d3edbec39786b326542aac1b4a2215e596f4821580153ea4.exe
Resource
win7-20240220-en
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
e4f63c24e7615203d3edbec39786b326542aac1b4a2215e596f4821580153ea4.exe
Resource
win10v2004-20240508-en
2 signatures
150 seconds
General
- Target e4f63c24e7615203d3edbec39786b326542aac1b4a2215e596f4821580153ea4.exe
- Size 344KB
- Sample240605-fatltafc64
- SHA256 e4f63c24e7615203d3edbec39786b326542aac1b4a2215e596f4821580153ea4
- MD5 b51ee24431729924132b1ea9a5c6808b
- SHA1 296d3544934b8d4c447950902fe7315aa1348fde
- SHA512 19ad0df1fc23bf069a10c065fbf54fe64f5983e9b009e55ee49e669a321eb2c26abbd0780cbd77c8efc4342dcbb8041f8038577097852f60313f35064d98b2fd
- SSDEEP 6144:9/QiQPx36jUcRHQ5JDn4fDM+rXIrfCv+p7n1KxTWYvZc:1QiGx3dSHeDn47VY7C2p71wxxc
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 3184 e4f63c24e7615203d3edbec39786b326542aac1b4a2215e596f4821580153ea4.tmp - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 864 wrote to memory of 3184 864 e4f63c24e7615203d3edbec39786b326542aac1b4a2215e596f4821580153ea4.exe 83 PID 864 wrote to memory of 3184 864 e4f63c24e7615203d3edbec39786b326542aac1b4a2215e596f4821580153ea4.exe 83 PID 864 wrote to memory of 3184 864 e4f63c24e7615203d3edbec39786b326542aac1b4a2215e596f4821580153ea4.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\e4f63c24e7615203d3edbec39786b326542aac1b4a2215e596f4821580153ea4.exe"C:\Users\Admin\AppData\Local\Temp\e4f63c24e7615203d3edbec39786b326542aac1b4a2215e596f4821580153ea4.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:864 -
C:\Users\Admin\AppData\Local\Temp\is-GE3N1.tmp\e4f63c24e7615203d3edbec39786b326542aac1b4a2215e596f4821580153ea4.tmp"C:\Users\Admin\AppData\Local\Temp\is-GE3N1.tmp\e4f63c24e7615203d3edbec39786b326542aac1b4a2215e596f4821580153ea4.tmp" /SL5="$7014A,69214,69120,C:\Users\Admin\AppData\Local\Temp\e4f63c24e7615203d3edbec39786b326542aac1b4a2215e596f4821580153ea4.exe"2⤵
- Executes dropped EXE
PID:3184
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\is-GE3N1.tmp\e4f63c24e7615203d3edbec39786b326542aac1b4a2215e596f4821580153ea4.tmp
- Size 702KB
- SHA256 2eb9a868417711304b4dcefbe842af0815fdac255adeea33ccf7a315237295e0
- MD5 10ce57aeb57e82d44e59dd6e65d3792c
- SHA1 26852dc1567bbed417b59c7feee80c2fd362cd12
- SHA512 514fe80edc2611aa403abe78dd8dcc868ad1ae2cad96e28206133b381e8d556c9b20412e376ef7f840c6b97fe1428bfa92306c0d2ab4c2fc801d56153d4aa4d2
- SSDEEP 12288:QTPcYn5c/rPx37/zHBA6a5UeYpthr1CERAgrNuR+1Iq5eRx9Rt:MPcYn5c/rPx37/zHBA6pFptZ1CEQqeRj
- MD5 SHA1 SHA512 SSDEEP