Analysis
- max time kernel
107s - max time network
177s - platform
windows10-2004_x64 - resource
win10v2004-20250502-en - resource tags
- submitted
02/06/2025, 22:44
General
- Target uploaded/1.exe
- Size 913KB
- Sample250602-2pacdabk21
- SHA256 6b4adc3f05b6f7968d826b26b6a472ad3906a5b659eae167bd3a922415c6133d
Malware Config
Signatures
- Drops desktop.ini file(s) 2 IoCs
- Drops file in Windows directory 3 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\uploaded\1.exe"C:\Users\Admin\AppData\Local\Temp\uploaded\1.exe"1⤵
- Drops desktop.ini file(s)
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\-m5otx8i.cmdline"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB0B3.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCB0B2.tmp"3⤵
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-m5otx8i.dll
RESB0B3.tmp
-m5otx8i.0.cs
-m5otx8i.cmdline
CSCB0B2.tmp
memory/2068-16-0x00007FFD38420000-0x00007FFD38DC1000-memory.dmp
memory/2068-21-0x00007FFD38420000-0x00007FFD38DC1000-memory.dmp
memory/2844-26-0x0000000001320000-0x0000000001328000-memory.dmp
memory/2844-28-0x000000001CE00000-0x000000001CE62000-memory.dmp
memory/2844-0-0x00007FFD386D5000-0x00007FFD386D6000-memory.dmp
memory/2844-8-0x00007FFD38420000-0x00007FFD38DC1000-memory.dmp
memory/2844-2-0x000000001B700000-0x000000001B75C000-memory.dmp
memory/2844-7-0x000000001C360000-0x000000001C3FC000-memory.dmp
memory/2844-23-0x000000001CA10000-0x000000001CA26000-memory.dmp
memory/2844-1-0x00007FFD38420000-0x00007FFD38DC1000-memory.dmp
memory/2844-25-0x000000001B660000-0x000000001B672000-memory.dmp
memory/2844-6-0x000000001BDF0000-0x000000001C2BE000-memory.dmp
memory/2844-27-0x000000001B6F0000-0x000000001B6F8000-memory.dmp
memory/2844-5-0x000000001B8F0000-0x000000001B8FE000-memory.dmp
memory/2844-29-0x000000001D760000-0x000000001DD1A000-memory.dmp
memory/2844-30-0x000000001DD20000-0x000000001DE10000-memory.dmp
memory/2844-31-0x000000001CF60000-0x000000001CF7E000-memory.dmp
memory/2844-32-0x000000001DE20000-0x000000001DE69000-memory.dmp
memory/2844-33-0x00007FFD38420000-0x00007FFD38DC1000-memory.dmp
memory/2844-34-0x000000001DF00000-0x000000001DF70000-memory.dmp
memory/2844-35-0x00007FFD38420000-0x00007FFD38DC1000-memory.dmp
memory/2844-37-0x000000001C490000-0x000000001C498000-memory.dmp
memory/2844-38-0x00007FFD386D5000-0x00007FFD386D6000-memory.dmp
memory/2844-39-0x00007FFD38420000-0x00007FFD38DC1000-memory.dmp
memory/2844-41-0x00007FFD38420000-0x00007FFD38DC1000-memory.dmp