Analysis
- max time kernel
118s - max time network
120s - platform
windows7_x64 - resource
win7-20240221-en - resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system - submitted
07/06/2024, 01:06
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
7250a15983e9f9b6f92c2c41b867bcbdca530bd41af97ff7b21f43cc9eaf27c4.exe
Resource
win7-20240221-en
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
7250a15983e9f9b6f92c2c41b867bcbdca530bd41af97ff7b21f43cc9eaf27c4.exe
Resource
win10v2004-20240226-en
3 signatures
150 seconds
General
- Target 7250a15983e9f9b6f92c2c41b867bcbdca530bd41af97ff7b21f43cc9eaf27c4.exe
- Size 4.2MB
- Sample240607-bf4azseh4w
- SHA256 7250a15983e9f9b6f92c2c41b867bcbdca530bd41af97ff7b21f43cc9eaf27c4
- MD5 657d3a0a69955f76e366205609fdc014
- SHA1 57f6a0498eccbba396cac45acabb7ea4bb4c4482
- SHA512 fd5c73804f11c60fc5efe9afca1e8d5bf244ef9b44cc59f721bd2ea458870e034a1dc22e3794064b30c56cc21e9df348a918e997e15f7ee5649170b28824e818
- SSDEEP 98304:Cmhd1Uryec1I0DLapXVLUjH5oxFbxhVLUjH5oxFbx:Cl3UapXVUjZEdhVUjZEd
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Deletes itself 1 IoCs
pid Process 2616 32B4.tmp - Executes dropped EXE 1 IoCs
pid Process 2616 32B4.tmp - Loads dropped DLL 2 IoCs
pid Process 2780 7250a15983e9f9b6f92c2c41b867bcbdca530bd41af97ff7b21f43cc9eaf27c4.exe 2780 7250a15983e9f9b6f92c2c41b867bcbdca530bd41af97ff7b21f43cc9eaf27c4.exe - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2780 wrote to memory of 2616 2780 7250a15983e9f9b6f92c2c41b867bcbdca530bd41af97ff7b21f43cc9eaf27c4.exe 28 PID 2780 wrote to memory of 2616 2780 7250a15983e9f9b6f92c2c41b867bcbdca530bd41af97ff7b21f43cc9eaf27c4.exe 28 PID 2780 wrote to memory of 2616 2780 7250a15983e9f9b6f92c2c41b867bcbdca530bd41af97ff7b21f43cc9eaf27c4.exe 28 PID 2780 wrote to memory of 2616 2780 7250a15983e9f9b6f92c2c41b867bcbdca530bd41af97ff7b21f43cc9eaf27c4.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\7250a15983e9f9b6f92c2c41b867bcbdca530bd41af97ff7b21f43cc9eaf27c4.exe"C:\Users\Admin\AppData\Local\Temp\7250a15983e9f9b6f92c2c41b867bcbdca530bd41af97ff7b21f43cc9eaf27c4.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2780 -
C:\Users\Admin\AppData\Local\Temp\32B4.tmp"C:\Users\Admin\AppData\Local\Temp\32B4.tmp" --splashC:\Users\Admin\AppData\Local\Temp\7250a15983e9f9b6f92c2c41b867bcbdca530bd41af97ff7b21f43cc9eaf27c4.exe A81E8B20D2BFC453F7B8A407FE5E1E7089EFC88F09CC23C9F54BEBFC89F69D2625CA9E3DDB42DB37E1FAB7A4B423265E472BDAB19BB2219778941ADF04F37BC32⤵
- Deletes itself
- Executes dropped EXE
PID:2616
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path \Users\Admin\AppData\Local\Temp\32B4.tmp
- Size 4.2MB
- SHA256 264062e182cacf58614654aa87d7798de9c1d3f7e33d9bfc3da906334e0d1a8f
- MD5 d14351c31516991068de8a85ef5dd776
- SHA1 fa11cea7a08bc1bafc2ff69ee7483ccc64a4947c
- SHA512 7e78ced74682799111870d63c8b0e619e1d0cca2eb5d56b583d3e410c53e16a0906ad30cdae64354fbde04eaf839d8b3ac317620e3190a68ee3cbe5b68c234ef
- SSDEEP 98304:Cmhd1Uryehw07kJmuEUj1dSn6rVLUjH5oxFbxhVLUjH5oxFbx:ClK4u71y6rVUjZEdhVUjZEd
- MD5 SHA1 SHA512 SSDEEP