Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
05-06-2024 16:13
Behavioral task
behavioral1
Sample
phoneactivate.exe
Resource
win7-20240508-en
General
-
Target
phoneactivate.exe
-
Size
6.0MB
-
MD5
313b06b3fd4fe10d7b554f228100c204
-
SHA1
520a459ffd001f30865a034b998f45e48bf583c6
-
SHA256
48ebe46d820a224bc674a6854bf36f5e7bc20ccf2f8e74acbd310c88d479b1e8
-
SHA512
049debe0926e7190f9768eb9a903813410394d0968b0e8cadd044f710269e097271fd67481e0acc3d1c71d511d5cd84f67a8f6ddfb1b7198600ddbd9b0eb4fdd
-
SSDEEP
98304:srz7EtdFBClamaHl3Ne4i3gmtfXJOLhx9fZAzDJ4wzQgsRuGK4RtOuAK5P58wM:srzyFIgeN/FJMIDJf0gsAGK4RouAK5KH
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 2448 phoneactivate.exe -
resource yara_rule behavioral1/files/0x0006000000016d32-21.dat upx -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2416 wrote to memory of 2448 2416 phoneactivate.exe 28 PID 2416 wrote to memory of 2448 2416 phoneactivate.exe 28 PID 2416 wrote to memory of 2448 2416 phoneactivate.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\phoneactivate.exe"C:\Users\Admin\AppData\Local\Temp\phoneactivate.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2416 -
C:\Users\Admin\AppData\Local\Temp\phoneactivate.exe"C:\Users\Admin\AppData\Local\Temp\phoneactivate.exe"2⤵
- Loads dropped DLL
PID:2448
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.4MB
MD5178a0f45fde7db40c238f1340a0c0ec0
SHA1dcd2d3d14e06da3e8d7dc91a69b5fd785768b5fe
SHA2569fcb5ad15bd33dd72122a171a5d950e8e47ceda09372f25df828010cde24b8ed
SHA5124b790046787e57b9414a796838a026b1530f497a75c8e62d62b56f8c16a0cbedbefad3d4be957bc18379f64374d8d3bf62d3c64b53476c7c5005a7355acd2cee