Analysis
-
max time kernel
118s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
20-06-2024 21:52
Behavioral task
behavioral1
Sample
4b9ecc0b095bc7205e7c865bee3e2e9f567db8fa2cf508c95b8d2c48c0c13cc9.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
4b9ecc0b095bc7205e7c865bee3e2e9f567db8fa2cf508c95b8d2c48c0c13cc9.exe
Resource
win10v2004-20240508-en
General
-
Target
4b9ecc0b095bc7205e7c865bee3e2e9f567db8fa2cf508c95b8d2c48c0c13cc9.exe
-
Size
6.8MB
-
MD5
479a5a80876b49f4abb7eac3a8dd1ee2
-
SHA1
a25ef507a41f09dd9152c96abaeebe6a9b6cad49
-
SHA256
4b9ecc0b095bc7205e7c865bee3e2e9f567db8fa2cf508c95b8d2c48c0c13cc9
-
SHA512
5b2db740147a187fdb506e9759b56d722e6e6ba7fa6d39e46f3bb05b4baa24ad509a793e6258b7c37ccfb65de7e3232b85e8e253c703829a335f31cda6153678
-
SSDEEP
98304:JisK8VkCIf8HDlhib7xazMD/x/0feyGgatVQ940BDlgwdnpka9R/k9t+28Gt+Gr+:UsKy7jlofBDfyGgMwBdnpkYRMOuPpsl
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
Processes:
4b9ecc0b095bc7205e7c865bee3e2e9f567db8fa2cf508c95b8d2c48c0c13cc9.exepid Process 2392 4b9ecc0b095bc7205e7c865bee3e2e9f567db8fa2cf508c95b8d2c48c0c13cc9.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
4b9ecc0b095bc7205e7c865bee3e2e9f567db8fa2cf508c95b8d2c48c0c13cc9.exedescription pid Process procid_target PID 2108 wrote to memory of 2392 2108 4b9ecc0b095bc7205e7c865bee3e2e9f567db8fa2cf508c95b8d2c48c0c13cc9.exe 29 PID 2108 wrote to memory of 2392 2108 4b9ecc0b095bc7205e7c865bee3e2e9f567db8fa2cf508c95b8d2c48c0c13cc9.exe 29 PID 2108 wrote to memory of 2392 2108 4b9ecc0b095bc7205e7c865bee3e2e9f567db8fa2cf508c95b8d2c48c0c13cc9.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\4b9ecc0b095bc7205e7c865bee3e2e9f567db8fa2cf508c95b8d2c48c0c13cc9.exe"C:\Users\Admin\AppData\Local\Temp\4b9ecc0b095bc7205e7c865bee3e2e9f567db8fa2cf508c95b8d2c48c0c13cc9.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2108 -
C:\Users\Admin\AppData\Local\Temp\4b9ecc0b095bc7205e7c865bee3e2e9f567db8fa2cf508c95b8d2c48c0c13cc9.exe"C:\Users\Admin\AppData\Local\Temp\4b9ecc0b095bc7205e7c865bee3e2e9f567db8fa2cf508c95b8d2c48c0c13cc9.exe"2⤵
- Loads dropped DLL
PID:2392
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4.3MB
MD563a1fa9259a35eaeac04174cecb90048
SHA10dc0c91bcd6f69b80dcdd7e4020365dd7853885a
SHA25614b06796f288bc6599e458fb23a944ab0c843e9868058f02a91d4606533505ed
SHA512896caa053f48b1e4102e0f41a7d13d932a746eea69a894ae564ef5a84ef50890514deca6496e915aae40a500955220dbc1b1016fe0b8bcdde0ad81b2917dea8b