Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
06/06/2024, 03:37
Static task
static1
Behavioral task
behavioral1
Sample
9aeebafd714822f5509e1a3bc54b7f9fbba394cd23ef4c0ba4397f8f76fb2e7d.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
9aeebafd714822f5509e1a3bc54b7f9fbba394cd23ef4c0ba4397f8f76fb2e7d.exe
Resource
win10v2004-20240426-en
General
-
Target
9aeebafd714822f5509e1a3bc54b7f9fbba394cd23ef4c0ba4397f8f76fb2e7d.exe
-
Size
197KB
-
MD5
e12a15bc7d5fc99173d26a5b7eb78c87
-
SHA1
0b50bfcebcfd03859eceb3ef79a2fb601b171bbd
-
SHA256
9aeebafd714822f5509e1a3bc54b7f9fbba394cd23ef4c0ba4397f8f76fb2e7d
-
SHA512
fa298620b2b8b457da2b2fce2ab02953208f36b0e2075b380a5dc41a1db18c64e134c64e89cbd4b64d757a5798ba755c153dfe5cc510223346584a5cfdb43770
-
SSDEEP
3072:WKb6zjbDi6WsMSkFMsFbfYmA4fZiCii9qLr3+FmTr7L1Y6wkbys0+VY9kWG8H6Ye:WKbkP1EnA4CgybTr/TbysCyGH6Y6l
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2920 9aeebafd714822f5509e1a3bc54b7f9fbba394cd23ef4c0ba4397f8f76fb2e7d.exe -
Executes dropped EXE 1 IoCs
pid Process 2920 9aeebafd714822f5509e1a3bc54b7f9fbba394cd23ef4c0ba4397f8f76fb2e7d.exe -
Loads dropped DLL 1 IoCs
pid Process 1740 9aeebafd714822f5509e1a3bc54b7f9fbba394cd23ef4c0ba4397f8f76fb2e7d.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2920 9aeebafd714822f5509e1a3bc54b7f9fbba394cd23ef4c0ba4397f8f76fb2e7d.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 1740 9aeebafd714822f5509e1a3bc54b7f9fbba394cd23ef4c0ba4397f8f76fb2e7d.exe -
Suspicious use of UnmapMainImage 1 IoCs
pid Process 2920 9aeebafd714822f5509e1a3bc54b7f9fbba394cd23ef4c0ba4397f8f76fb2e7d.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1740 wrote to memory of 2920 1740 9aeebafd714822f5509e1a3bc54b7f9fbba394cd23ef4c0ba4397f8f76fb2e7d.exe 28 PID 1740 wrote to memory of 2920 1740 9aeebafd714822f5509e1a3bc54b7f9fbba394cd23ef4c0ba4397f8f76fb2e7d.exe 28 PID 1740 wrote to memory of 2920 1740 9aeebafd714822f5509e1a3bc54b7f9fbba394cd23ef4c0ba4397f8f76fb2e7d.exe 28 PID 1740 wrote to memory of 2920 1740 9aeebafd714822f5509e1a3bc54b7f9fbba394cd23ef4c0ba4397f8f76fb2e7d.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\9aeebafd714822f5509e1a3bc54b7f9fbba394cd23ef4c0ba4397f8f76fb2e7d.exe"C:\Users\Admin\AppData\Local\Temp\9aeebafd714822f5509e1a3bc54b7f9fbba394cd23ef4c0ba4397f8f76fb2e7d.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1740 -
C:\Users\Admin\AppData\Local\Temp\9aeebafd714822f5509e1a3bc54b7f9fbba394cd23ef4c0ba4397f8f76fb2e7d.exeC:\Users\Admin\AppData\Local\Temp\9aeebafd714822f5509e1a3bc54b7f9fbba394cd23ef4c0ba4397f8f76fb2e7d.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of UnmapMainImage
PID:2920
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\9aeebafd714822f5509e1a3bc54b7f9fbba394cd23ef4c0ba4397f8f76fb2e7d.exe
Filesize197KB
MD5f93c73f1c855a11a3fc1992d19c9d99b
SHA1f0a84d5af76a335a7c62f680e53e1f8bbb92b245
SHA256375d261736a46bdc3863966d2cfb8662f641e31853b7be8475f95bb9bc36030d
SHA512309fc6d5985a82c461ad4803e17a98b7cbdb1bcee1b6acfecd16fbd9f612800c7ae64997375af64819a956aff1968805d8cbfa6da037b20dedc222502c48cadc