Analysis
-
max time kernel
118s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
-
submitted
04-07-2024 04:14
General
-
Target
d6792bbdbdca978d8ea26079cc5e22325bedc0e8242d02c6d9072a765359e3bd.exe
-
Size
416KB
-
MD5
36cbe7b229e6cb04f48bd68288e1200f
-
SHA1
51f47baeb0f0771e436befd9ec905403a4d9fe24
-
SHA256
d6792bbdbdca978d8ea26079cc5e22325bedc0e8242d02c6d9072a765359e3bd
-
SHA512
9d66b182621c52023c418ad76e91a9300d004f6eabe9c814ee12f6b9fd59d4ba638234c5755bb7740f7b3107e42b897f4b9cdd7e15497757c8ac69e43f0c790c
-
SSDEEP
12288:ScMiJGzgXzCwakjYeF4/SiotZwJRa2vLPjfx5m84prF:tlOgDCwakjYeF4/SiotZwJRa2vLPjfxo
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d6792bbdbdca978d8ea26079cc5e22325bedc0e8242d02c6d9072a765359e3bd.exe"C:\Users\Admin\AppData\Local\Temp\d6792bbdbdca978d8ea26079cc5e22325bedc0e8242d02c6d9072a765359e3bd.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\d6792bbdbdca978d8ea26079cc5e22325bedc0e8242d02c6d9072a765359e3bd.exeC:\Users\Admin\AppData\Local\Temp\d6792bbdbdca978d8ea26079cc5e22325bedc0e8242d02c6d9072a765359e3bd.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
416KB
MD556c9ed74a28b0a7e8fa6080ac5c5d93c
SHA156dd9ed353156f024a0dc86c89f8d86b9eab7325
SHA2561ac5d60ce37a4eefe2ecf3704af7b221a09ab0ca4269ad4455a616dc6a67e39b
SHA5120304a9ff239275afa9eb4e7f51ff6c65afae7a4fd2470532735eb6899b9436cf1ffcc58a1998dfed7229b1c74b19a7eb23157cedfbebaf079cd34e12583af12a
-
Filesize
228KB
-
Filesize
228KB
-
Filesize
228KB
-
Filesize
228KB
-
Filesize
104KB
-
Filesize
228KB