Analysis
-
max time kernel
51s -
max time network
51s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
15/06/2024, 01:55
Static task
static1
Behavioral task
behavioral1
Sample
89925295e5c23768d82da3de65d651e0.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
89925295e5c23768d82da3de65d651e0.exe
Resource
win10v2004-20240508-en
General
-
Target
89925295e5c23768d82da3de65d651e0.exe
-
Size
4.8MB
-
MD5
89925295e5c23768d82da3de65d651e0
-
SHA1
3d302d5a23193d4a595fc3fbbc5e98d777cc8e45
-
SHA256
e21fcb47f2a9b3503c4bce760294c593d42332ee31b7e6e8d8c5311aa709ba19
-
SHA512
20931511ee0f06c01cca826677c0b27e42841b83151a40ffc6b635c0d6030f3fa8b9993cd42befc4dde8b23920778d6490be8e6a403f2a0288a05c4042d2917d
-
SSDEEP
98304:emhd1UryeZohI8+UjVGKPHCxZV7wQqZUha5jtSyR:elmhI8+UBl/MZ2QbaZtlR
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 3968 59B9.tmp -
Executes dropped EXE 1 IoCs
pid Process 3968 59B9.tmp -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1416 wrote to memory of 3968 1416 89925295e5c23768d82da3de65d651e0.exe 85 PID 1416 wrote to memory of 3968 1416 89925295e5c23768d82da3de65d651e0.exe 85 PID 1416 wrote to memory of 3968 1416 89925295e5c23768d82da3de65d651e0.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\89925295e5c23768d82da3de65d651e0.exe"C:\Users\Admin\AppData\Local\Temp\89925295e5c23768d82da3de65d651e0.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1416 -
C:\Users\Admin\AppData\Local\Temp\59B9.tmp"C:\Users\Admin\AppData\Local\Temp\59B9.tmp" --splashC:\Users\Admin\AppData\Local\Temp\89925295e5c23768d82da3de65d651e0.exe B7017282F673DA05A747D7649681A538DD4DE0B00D2C09F8B7F90705574D402860257DFFC10C02D8ED37C389E6E133C613FF8103945B0C4F9D9A64B8BB651D582⤵
- Deletes itself
- Executes dropped EXE
PID:3968
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4.8MB
MD579e017ae5f42a009556ae0c5fba07a97
SHA1d3f6a5f7cc085fb5d695ae06ad23e6587f47b1ef
SHA25677bcb53ca806ae639fa2aa5e31f2d2bca205a0ca1a9dd19b2e2ca8ca4e2f2802
SHA512f3de08eda476d723f84f45a723962960764e355a12968e879abd3900024133e8012704c39e6512ceda42cf61fd73f351d2b881a99c18b70f85ffeed4d8e23ea8