Analysis
-
max time kernel
118s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
14-10-2024 01:53
Behavioral task
behavioral1
Sample
c2973f7cacf16cecac8e6794c37039697a4c91814cc2706434a3e8d175cbc6d3.exe
Resource
win7-20240903-en
General
-
Target
c2973f7cacf16cecac8e6794c37039697a4c91814cc2706434a3e8d175cbc6d3.exe
-
Size
7.4MB
-
MD5
1069ade6b99d29bfe4d0526e23ed714d
-
SHA1
47fe8ecfe75b239ed1d5eb8b867a1a9f091c510c
-
SHA256
c2973f7cacf16cecac8e6794c37039697a4c91814cc2706434a3e8d175cbc6d3
-
SHA512
a9391f3aed86c8add2bec2d1b40cb88ae9d7b91dea3b5c35d477fef2569c0d680b2cc308f2a2420a73f647f8e7bc844af5cf73d0fbfcd5a294b8b36262ecb5aa
-
SSDEEP
98304:HpnMcOstxurErvz81LpWjjUlLkvzgXO9hAlaYrzzuJZYJ1JIuI/KU73bcgVowjMz:JzurErvI9pWjgyvoaYrE41JIuICoxU
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 2720 c2973f7cacf16cecac8e6794c37039697a4c91814cc2706434a3e8d175cbc6d3.exe -
resource yara_rule behavioral1/files/0x000600000001752f-21.dat upx behavioral1/memory/2720-23-0x000007FEF6030000-0x000007FEF6620000-memory.dmp upx -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1720 wrote to memory of 2720 1720 c2973f7cacf16cecac8e6794c37039697a4c91814cc2706434a3e8d175cbc6d3.exe 32 PID 1720 wrote to memory of 2720 1720 c2973f7cacf16cecac8e6794c37039697a4c91814cc2706434a3e8d175cbc6d3.exe 32 PID 1720 wrote to memory of 2720 1720 c2973f7cacf16cecac8e6794c37039697a4c91814cc2706434a3e8d175cbc6d3.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\c2973f7cacf16cecac8e6794c37039697a4c91814cc2706434a3e8d175cbc6d3.exe"C:\Users\Admin\AppData\Local\Temp\c2973f7cacf16cecac8e6794c37039697a4c91814cc2706434a3e8d175cbc6d3.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1720 -
C:\Users\Admin\AppData\Local\Temp\c2973f7cacf16cecac8e6794c37039697a4c91814cc2706434a3e8d175cbc6d3.exe"C:\Users\Admin\AppData\Local\Temp\c2973f7cacf16cecac8e6794c37039697a4c91814cc2706434a3e8d175cbc6d3.exe"2⤵
- Loads dropped DLL
PID:2720
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.6MB
MD5b167b98fc5c89d65cb1fa8df31c5de13
SHA13a6597007f572ea09ed233d813462e80e14c5444
SHA25628eda3ba32f5247c1a7bd2777ead982c24175765c4e2c1c28a0ef708079f2c76
SHA51240a1f5cd2af7e7c28d4c8e327310ea1982478a9f6d300950c7372634df0d9ad840f3c64fe35cc01db4c798bd153b210c0a8472ae0898bebf8cf9c25dd3638de8