Analysis
- max time kernel
842s - max time network
843s - platform
windows7_x64 - resource
win7-20240708-en - resource tags
- submitted
22/11/2024, 02:36
General
- Target 6f772eb660bc05fc26df86c98ca49abc.exe
- Size 138KB
- Sample241122-c3zrraspfs
- SHA256 7b53a00b3a8859755f6144cb2149673fa17fdd6e439cbfdee21a7a513e6395b2
Malware Config
Signatures
- Deletes itself 1 IoCs
- Executes dropped EXE 1 IoCs
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\6f772eb660bc05fc26df86c98ca49abc.exe"C:\Users\Admin\AppData\Local\Temp\6f772eb660bc05fc26df86c98ca49abc.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
\Users\Admin\AppData\Roaming\msiexec.exe2⤵
- Deletes itself
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
msiexec.exe
memory/1748-22-0x0000000005350000-0x0000000005459000-memory.dmp
memory/1748-3-0x0000000000720000-0x0000000000737000-memory.dmp
memory/1748-404-0x0000000000B60000-0x0000000000B61000-memory.dmp
memory/1748-403-0x0000000000B50000-0x0000000000B51000-memory.dmp
memory/1748-402-0x0000000000B40000-0x0000000000B41000-memory.dmp
memory/1748-401-0x0000000000B30000-0x0000000000B31000-memory.dmp
memory/1748-400-0x0000000000B20000-0x0000000000B21000-memory.dmp
memory/1748-399-0x0000000000B10000-0x0000000000B11000-memory.dmp
memory/1748-398-0x0000000000B00000-0x0000000000B01000-memory.dmp
memory/1748-89-0x0000000000AF0000-0x0000000000AF1000-memory.dmp
memory/1748-405-0x0000000001410000-0x0000000001411000-memory.dmp
memory/1748-2-0x00000000004F0000-0x000000000061D000-memory.dmp
memory/1748-21-0x0000000001240000-0x0000000001309000-memory.dmp
memory/1748-1-0x0000000000140000-0x000000000015F000-memory.dmp
memory/1748-0-0x0000000000450000-0x00000000004EF000-memory.dmp
memory/1748-406-0x0000000001420000-0x0000000001491000-memory.dmp
memory/3468-1322-0x00000000002A0000-0x00000000002C8000-memory.dmp
memory/3468-532-0x00000000002A0000-0x00000000002C8000-memory.dmp
memory/3468-577-0x00000000002A0000-0x00000000002C8000-memory.dmp
memory/3468-530-0x000007FFFFFDB000-0x000007FFFFFDC000-memory.dmp
memory/3468-528-0x000000001F9F0000-0x000000001FA0F000-memory.dmp