Analysis

  • max time kernel
    51s
  • max time network
    51s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15/06/2024, 01:55

General

  • Target

    89925295e5c23768d82da3de65d651e0.exe

  • Size

    4.8MB

  • MD5

    89925295e5c23768d82da3de65d651e0

  • SHA1

    3d302d5a23193d4a595fc3fbbc5e98d777cc8e45

  • SHA256

    e21fcb47f2a9b3503c4bce760294c593d42332ee31b7e6e8d8c5311aa709ba19

  • SHA512

    20931511ee0f06c01cca826677c0b27e42841b83151a40ffc6b635c0d6030f3fa8b9993cd42befc4dde8b23920778d6490be8e6a403f2a0288a05c4042d2917d

  • SSDEEP

    98304:emhd1UryeZohI8+UjVGKPHCxZV7wQqZUha5jtSyR:elmhI8+UBl/MZ2QbaZtlR

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\89925295e5c23768d82da3de65d651e0.exe
    "C:\Users\Admin\AppData\Local\Temp\89925295e5c23768d82da3de65d651e0.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1416
    • C:\Users\Admin\AppData\Local\Temp\59B9.tmp
      "C:\Users\Admin\AppData\Local\Temp\59B9.tmp" --splashC:\Users\Admin\AppData\Local\Temp\89925295e5c23768d82da3de65d651e0.exe B7017282F673DA05A747D7649681A538DD4DE0B00D2C09F8B7F90705574D402860257DFFC10C02D8ED37C389E6E133C613FF8103945B0C4F9D9A64B8BB651D58
      2⤵
      • Deletes itself
      • Executes dropped EXE
      PID:3968

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\59B9.tmp

    Filesize

    4.8MB

    MD5

    79e017ae5f42a009556ae0c5fba07a97

    SHA1

    d3f6a5f7cc085fb5d695ae06ad23e6587f47b1ef

    SHA256

    77bcb53ca806ae639fa2aa5e31f2d2bca205a0ca1a9dd19b2e2ca8ca4e2f2802

    SHA512

    f3de08eda476d723f84f45a723962960764e355a12968e879abd3900024133e8012704c39e6512ceda42cf61fd73f351d2b881a99c18b70f85ffeed4d8e23ea8

  • memory/1416-0-0x0000000000400000-0x0000000000849000-memory.dmp

    Filesize

    4.3MB

  • memory/3968-5-0x0000000000400000-0x0000000000849000-memory.dmp

    Filesize

    4.3MB