Analysis

  • max time kernel
    121s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240220-en
  • resource tags

    arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
  • submitted
    06/06/2024, 03:37

General

  • Target

    9aeebafd714822f5509e1a3bc54b7f9fbba394cd23ef4c0ba4397f8f76fb2e7d.exe

  • Size

    197KB

  • MD5

    e12a15bc7d5fc99173d26a5b7eb78c87

  • SHA1

    0b50bfcebcfd03859eceb3ef79a2fb601b171bbd

  • SHA256

    9aeebafd714822f5509e1a3bc54b7f9fbba394cd23ef4c0ba4397f8f76fb2e7d

  • SHA512

    fa298620b2b8b457da2b2fce2ab02953208f36b0e2075b380a5dc41a1db18c64e134c64e89cbd4b64d757a5798ba755c153dfe5cc510223346584a5cfdb43770

  • SSDEEP

    3072:WKb6zjbDi6WsMSkFMsFbfYmA4fZiCii9qLr3+FmTr7L1Y6wkbys0+VY9kWG8H6Ye:WKbkP1EnA4CgybTr/TbysCyGH6Y6l

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\9aeebafd714822f5509e1a3bc54b7f9fbba394cd23ef4c0ba4397f8f76fb2e7d.exe
    "C:\Users\Admin\AppData\Local\Temp\9aeebafd714822f5509e1a3bc54b7f9fbba394cd23ef4c0ba4397f8f76fb2e7d.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: RenamesItself
    • Suspicious use of WriteProcessMemory
    PID:1740
    • C:\Users\Admin\AppData\Local\Temp\9aeebafd714822f5509e1a3bc54b7f9fbba394cd23ef4c0ba4397f8f76fb2e7d.exe
      C:\Users\Admin\AppData\Local\Temp\9aeebafd714822f5509e1a3bc54b7f9fbba394cd23ef4c0ba4397f8f76fb2e7d.exe
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of UnmapMainImage
      PID:2920

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\9aeebafd714822f5509e1a3bc54b7f9fbba394cd23ef4c0ba4397f8f76fb2e7d.exe

    Filesize

    197KB

    MD5

    f93c73f1c855a11a3fc1992d19c9d99b

    SHA1

    f0a84d5af76a335a7c62f680e53e1f8bbb92b245

    SHA256

    375d261736a46bdc3863966d2cfb8662f641e31853b7be8475f95bb9bc36030d

    SHA512

    309fc6d5985a82c461ad4803e17a98b7cbdb1bcee1b6acfecd16fbd9f612800c7ae64997375af64819a956aff1968805d8cbfa6da037b20dedc222502c48cadc

  • memory/1740-0-0x0000000000400000-0x000000000043F000-memory.dmp

    Filesize

    252KB

  • memory/1740-6-0x0000000000340000-0x000000000037F000-memory.dmp

    Filesize

    252KB

  • memory/1740-9-0x0000000000400000-0x000000000043F000-memory.dmp

    Filesize

    252KB

  • memory/2920-11-0x0000000000400000-0x0000000000415000-memory.dmp

    Filesize

    84KB

  • memory/2920-16-0x0000000000180000-0x00000000001BF000-memory.dmp

    Filesize

    252KB

  • memory/2920-17-0x0000000000400000-0x000000000043F000-memory.dmp

    Filesize

    252KB