Analysis
-
max time kernel
119s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
04/07/2024, 19:38
General
-
Target
04a9216ee52e5aabdebc48ac601f831575af6ca21acd626a95fed8816162fe1d.exe
-
Size
619KB
-
MD5
14d66776c590c923577852da0cc8f200
-
SHA1
5061bdacfa1f552614e64a3c6d88c7931ab28bf4
-
SHA256
04a9216ee52e5aabdebc48ac601f831575af6ca21acd626a95fed8816162fe1d
-
SHA512
3cca61bfb603693e21dda8fd0402896bea87a5db04f405f61863fba52522510a241d51bd75296fd9552b0dc0ce49f66d20173aced0b8b9032b834ee8ecbb432c
-
SSDEEP
12288:4EEProZBrN7U5axPVQ5zCD4VZRDGWF1m3aYhOA6eXVg:AToZBxbPVQ5zY431CaYAeXVg
Score
7/10
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\04a9216ee52e5aabdebc48ac601f831575af6ca21acd626a95fed8816162fe1d.exe"C:\Users\Admin\AppData\Local\Temp\04a9216ee52e5aabdebc48ac601f831575af6ca21acd626a95fed8816162fe1d.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\04a9216ee52e5aabdebc48ac601f831575af6ca21acd626a95fed8816162fe1d.exeC:\Users\Admin\AppData\Local\Temp\04a9216ee52e5aabdebc48ac601f831575af6ca21acd626a95fed8816162fe1d.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
619KB
MD5d085eca0921f1814222da0bdb7a0c827
SHA13c1fb4d2341aa7f900b1cd001dbc150f7db7ef83
SHA2565f531ca1d229c911182bdd0f41e6dc3f4fc219823f34699ed06a9b00d646e326
SHA512b30e5d8797ca606113d7f2da55753ea013e07f1d2327ee11a252761bced15df2370da41db24e3ea6fbc2ed478e5250ad2a68cf5f6ed5ca2a2948af6733d0c0c6
-
Filesize
264KB
-
Filesize
104KB
-
Filesize
264KB
-
Filesize
264KB
-
Filesize
264KB