Analysis

  • max time kernel
    15s
  • max time network
    17s
  • platform
    windows7_x64
  • resource
    win7-20240705-en
  • resource tags

    arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
  • submitted
    25/07/2024, 14:10

General

  • Target

    d76a0bed693d3e0efb11ff9468e616e0N.exe

  • Size

    274KB

  • MD5

    d76a0bed693d3e0efb11ff9468e616e0

  • SHA1

    4749be257076bd0c785f619cc38e29962b40af38

  • SHA256

    b06a892c73a5af776987f44ab25b822b3e0bae23fa1f9a7496d04305fa64f6fa

  • SHA512

    76d8deecd8a968e26fad2d26e06d2872f513d5b7822e1506e9b119df9a79a9e1989ea2b2a93a6e3260fe11042a1f332e51bda4a645963f56d86299319a528fef

  • SSDEEP

    6144:8wmrornupqo+PjkifM23Yy9JAwceT90xfsLP:8+Q2jki+yTDcI9ufm

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d76a0bed693d3e0efb11ff9468e616e0N.exe
    "C:\Users\Admin\AppData\Local\Temp\d76a0bed693d3e0efb11ff9468e616e0N.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: RenamesItself
    • Suspicious use of WriteProcessMemory
    PID:1624
    • C:\Users\Admin\AppData\Local\Temp\d76a0bed693d3e0efb11ff9468e616e0N.exe
      C:\Users\Admin\AppData\Local\Temp\d76a0bed693d3e0efb11ff9468e616e0N.exe
      2⤵
      • Deletes itself
      • Executes dropped EXE
      PID:2108

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\d76a0bed693d3e0efb11ff9468e616e0N.exe

    Filesize

    274KB

    MD5

    c5ef16a07073b043e2f95850b5f49de2

    SHA1

    9f53bfcfd6c6bc683053f9d710de6f07c99a2724

    SHA256

    4e9f4fe22c565d401bd8be94d19d0860654c7218e0afa09b4980d51f8173f69e

    SHA512

    1353ec82e1d586c697753888746989382b86470e9b92276044539094c0263c934e8b59459800422b9cd7cdc9472ebadb5d02271e0ae90b77636a25836da86d54

  • memory/1624-0-0x0000000000400000-0x0000000000452000-memory.dmp

    Filesize

    328KB

  • memory/1624-6-0x0000000000310000-0x0000000000362000-memory.dmp

    Filesize

    328KB

  • memory/1624-11-0x0000000000400000-0x0000000000452000-memory.dmp

    Filesize

    328KB

  • memory/1624-10-0x0000000000400000-0x0000000000452000-memory.dmp

    Filesize

    328KB

  • memory/2108-12-0x0000000000400000-0x0000000000452000-memory.dmp

    Filesize

    328KB

  • memory/2108-14-0x0000000000400000-0x0000000000452000-memory.dmp

    Filesize

    328KB