Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
-
submitted
10/06/2024, 12:59
General
-
Target
4aa087520aedc2a3738613988631a85c2db89408d8da4f24bf46be74457f8083.exe
-
Size
7.8MB
-
MD5
44b2b48c3729f8435cf18f0e98a06e4e
-
SHA1
b5adfc5cfcf89f66c9b0abe8a1826731fa5e24f6
-
SHA256
4aa087520aedc2a3738613988631a85c2db89408d8da4f24bf46be74457f8083
-
SHA512
c955e35aee0844b1fc410f4c53e36f1f0d0e3e87845784ad0f7fc8f9786313e5e88a1889bde458ca8d0cb0eb4bde97d75a20c25374b5f5874d479f37a7fc56a4
-
SSDEEP
98304:emhd1Uryes1nrMis71O3SeyK8dV7wQqZUha5jtSyZIUb:elM1rts71Od8d2QbaZtli
Score
7/10
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\4aa087520aedc2a3738613988631a85c2db89408d8da4f24bf46be74457f8083.exe"C:\Users\Admin\AppData\Local\Temp\4aa087520aedc2a3738613988631a85c2db89408d8da4f24bf46be74457f8083.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2858.tmp"C:\Users\Admin\AppData\Local\Temp\2858.tmp" --splashC:\Users\Admin\AppData\Local\Temp\4aa087520aedc2a3738613988631a85c2db89408d8da4f24bf46be74457f8083.exe C8B6CA6A1DADEAA87BFD8950E543E42ABD48612B529EC1973FFA3108A994FF68860FEF975E440F4BBB409A3F3B001C8204C229E1B75B5A03B6C6356D574897782⤵
- Deletes itself
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
7.8MB
MD517902649c9b9d2c59b8b176274e8dc8b
SHA14969925a8849996d36d12b0497e8fb9a627c5e9e
SHA256423033e098ad02cf8fdaccc8028f0706fd42aabc78e9c89aa53f56976732c8c9
SHA512b70dd333d36c42d4fc4358008d1d43b886ad16c16c3eedd679b95bf93b81d3ad5bc1f3f19b2886443d4d43bdfca399f52e80fd2d7f1d295b7671bad17e45aea9
-
Filesize
4.3MB
-
Filesize
4.3MB