Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
09-12-2024 15:32
Behavioral task
behavioral1
Sample
8a5b97d932599b54784da43d0ae1c0ba907180ec8d1397f5e18357ff955d116d.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
8a5b97d932599b54784da43d0ae1c0ba907180ec8d1397f5e18357ff955d116d.exe
Resource
win10v2004-20241007-en
General
-
Target
8a5b97d932599b54784da43d0ae1c0ba907180ec8d1397f5e18357ff955d116d.exe
-
Size
6.0MB
-
MD5
3a875db37aebb1662c841f67230446cc
-
SHA1
7f8dfc6a2300a98fa92d38de90461d3ea0256811
-
SHA256
8a5b97d932599b54784da43d0ae1c0ba907180ec8d1397f5e18357ff955d116d
-
SHA512
2c63bd754badd0dc8e5b3263a9f1cf0259643af7a17feba9e62846614a0519c2363ae1f88eb20b1d6f95da12dd07ea33b364501738005a09d53704aea71fd424
-
SSDEEP
98304:Xrz4EtdFBC/JamaHl3Ne4i3gmtfXJOLhx9fZAzDJ4wzQgsRuGK4RjOuAKpz6rlU1:Xrz/FIseN/FJMIDJf0gsAGK4RiuAKpm2
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 2220 8a5b97d932599b54784da43d0ae1c0ba907180ec8d1397f5e18357ff955d116d.exe -
resource yara_rule behavioral1/files/0x000500000001871c-21.dat upx -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2380 wrote to memory of 2220 2380 8a5b97d932599b54784da43d0ae1c0ba907180ec8d1397f5e18357ff955d116d.exe 30 PID 2380 wrote to memory of 2220 2380 8a5b97d932599b54784da43d0ae1c0ba907180ec8d1397f5e18357ff955d116d.exe 30 PID 2380 wrote to memory of 2220 2380 8a5b97d932599b54784da43d0ae1c0ba907180ec8d1397f5e18357ff955d116d.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\8a5b97d932599b54784da43d0ae1c0ba907180ec8d1397f5e18357ff955d116d.exe"C:\Users\Admin\AppData\Local\Temp\8a5b97d932599b54784da43d0ae1c0ba907180ec8d1397f5e18357ff955d116d.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2380 -
C:\Users\Admin\AppData\Local\Temp\8a5b97d932599b54784da43d0ae1c0ba907180ec8d1397f5e18357ff955d116d.exe"C:\Users\Admin\AppData\Local\Temp\8a5b97d932599b54784da43d0ae1c0ba907180ec8d1397f5e18357ff955d116d.exe"2⤵
- Loads dropped DLL
PID:2220
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.4MB
MD5178a0f45fde7db40c238f1340a0c0ec0
SHA1dcd2d3d14e06da3e8d7dc91a69b5fd785768b5fe
SHA2569fcb5ad15bd33dd72122a171a5d950e8e47ceda09372f25df828010cde24b8ed
SHA5124b790046787e57b9414a796838a026b1530f497a75c8e62d62b56f8c16a0cbedbefad3d4be957bc18379f64374d8d3bf62d3c64b53476c7c5005a7355acd2cee