Analysis
-
max time kernel
117s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
24-06-2024 06:05
Static task
static1
Behavioral task
behavioral1
Sample
de78f05822b58389a08df867280df451.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
de78f05822b58389a08df867280df451.exe
Resource
win10v2004-20240611-en
General
-
Target
de78f05822b58389a08df867280df451.exe
-
Size
38.8MB
-
MD5
de78f05822b58389a08df867280df451
-
SHA1
d27954678d26afb60dd51750f69520a79bf8b997
-
SHA256
f589fcc7eadd141cd236de03b7fd786668017655a0adeb057cd343f95117a6f1
-
SHA512
8374e56d7d3e8ced16e15cd8c34e7059feacb94964b4a50c22cbf6d3045f2c52119d0393f218d0d4b445afa6ce12f607c85b09b82859275d81ebc91880ebe5d2
-
SSDEEP
786432:DCyIg99ycT/7t7OB2K4oX5Znw0e7s0sjgTTb2:DCxg99yaTt7G2K4opd3e7s0sjy
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
de78f05822b58389a08df867280df451.exepid process 1724 de78f05822b58389a08df867280df451.exe 1232 -
Loads dropped DLL 2 IoCs
Processes:
de78f05822b58389a08df867280df451.exepid process 2932 de78f05822b58389a08df867280df451.exe 1232 -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
de78f05822b58389a08df867280df451.exedescription pid process target process PID 2932 wrote to memory of 1724 2932 de78f05822b58389a08df867280df451.exe de78f05822b58389a08df867280df451.exe PID 2932 wrote to memory of 1724 2932 de78f05822b58389a08df867280df451.exe de78f05822b58389a08df867280df451.exe PID 2932 wrote to memory of 1724 2932 de78f05822b58389a08df867280df451.exe de78f05822b58389a08df867280df451.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\de78f05822b58389a08df867280df451.exe"C:\Users\Admin\AppData\Local\Temp\de78f05822b58389a08df867280df451.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\de78f05822b58389a08df867280df451-6a67828daf45d171\de78f05822b58389a08df867280df451.exe"C:\Users\Admin\AppData\Local\Temp\de78f05822b58389a08df867280df451-6a67828daf45d171\de78f05822b58389a08df867280df451.exe"2⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\de78f05822b58389a08df867280df451-6a67828daf45d171\de78f05822b58389a08df867280df451.exeFilesize
42.5MB
MD518c3c899c9a4b44417d8153a948ae5ca
SHA18560c64c60ce15cb849b031d0690793e8b8793ec
SHA25601e5fb6db31037b5e6f6ac1839d556c806b3fbdb31c2b4f5a7c19734e5420c70
SHA512d058c166ca467978ce69b5a7ae16bd85c190ff9de562c020214c81e255e1ea0cecd132683d38302ac1cdb8f1399d89dd85d33fdf3b5a243812dd510fb1556cf4