Analysis

  • max time kernel
    147s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10/06/2024, 12:59

General

  • Target

    4aa087520aedc2a3738613988631a85c2db89408d8da4f24bf46be74457f8083.exe

  • Size

    7.8MB

  • MD5

    44b2b48c3729f8435cf18f0e98a06e4e

  • SHA1

    b5adfc5cfcf89f66c9b0abe8a1826731fa5e24f6

  • SHA256

    4aa087520aedc2a3738613988631a85c2db89408d8da4f24bf46be74457f8083

  • SHA512

    c955e35aee0844b1fc410f4c53e36f1f0d0e3e87845784ad0f7fc8f9786313e5e88a1889bde458ca8d0cb0eb4bde97d75a20c25374b5f5874d479f37a7fc56a4

  • SSDEEP

    98304:emhd1Uryes1nrMis71O3SeyK8dV7wQqZUha5jtSyZIUb:elM1rts71Od8d2QbaZtli

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4aa087520aedc2a3738613988631a85c2db89408d8da4f24bf46be74457f8083.exe
    "C:\Users\Admin\AppData\Local\Temp\4aa087520aedc2a3738613988631a85c2db89408d8da4f24bf46be74457f8083.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4296
    • C:\Users\Admin\AppData\Local\Temp\421A.tmp
      "C:\Users\Admin\AppData\Local\Temp\421A.tmp" --splashC:\Users\Admin\AppData\Local\Temp\4aa087520aedc2a3738613988631a85c2db89408d8da4f24bf46be74457f8083.exe CDFC13375DBED68A492C633E0E3C73D4EFB522985354914CD165F5BBF2848A756660ED6BC10F22FC9CE502E9E7C7D2624AE6380723B965D639C238C3369197A7
      2⤵
      • Deletes itself
      • Executes dropped EXE
      PID:2380

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\421A.tmp

    Filesize

    7.8MB

    MD5

    742f0b8f080980a9f87bff5fb94d9698

    SHA1

    26265ee4f6834dccef01e9e4b2d51a14274c4a28

    SHA256

    48fec8efdcb64ed1178405d385d9304a05a50bb99c11935b31a827f31d39a8bb

    SHA512

    56a9c9f1ba0b53c9a4b005cb4bd2c731b9c6f973705ef8057c5442466a6f9e77ab723dc30a67b315470fed8b06eee0aee38788d3aff9c8c51a2fa802ff392119

  • memory/2380-5-0x0000000000400000-0x0000000000849000-memory.dmp

    Filesize

    4.3MB

  • memory/4296-0-0x0000000000400000-0x0000000000849000-memory.dmp

    Filesize

    4.3MB