Analysis
-
max time kernel
217s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
07-03-2024 15:18
Static task
static1
Behavioral task
behavioral1
Sample
sample.exe
Resource
win7-20240221-en
3 signatures
1800 seconds
General
-
Target
sample.exe
-
Size
1.2MB
-
MD5
01c13144ea9d9728500dc6c067bab899
-
SHA1
49b22529fec0c372b08e2afe67eccde13b3ab6cc
-
SHA256
eb846bb491bea698b99eab80d58fd1f2530b0c1ee5588f7ea02ce0ce209ddb60
-
SHA512
c05cff167a896ceddb55ab7070301f815f5e4f690e046e30ca6b4381f375ce579d516a70c41b750710e73524d3d092dc9de871cb43be2efc565fd753db2fc2b6
-
SSDEEP
12288:eQnGcWctmPF319Ib4k24VdTl2ZYFphgIShQuSGDkDFuyjldrB:ecjZtmN7jOVdB2ZYFpqhhoGYDFuol
Malware Config
Signatures
-
Detects VSingle payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/2668-2-0x00000000000D0000-0x0000000000101000-memory.dmp family_vsingle behavioral1/memory/2668-3-0x0000000000220000-0x0000000000257000-memory.dmp family_vsingle behavioral1/memory/2668-6-0x0000000000220000-0x0000000000257000-memory.dmp family_vsingle behavioral1/memory/2668-7-0x0000000000220000-0x0000000000257000-memory.dmp family_vsingle -
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
sample.exedescription pid process target process PID 2452 wrote to memory of 2668 2452 sample.exe Explorer.exe PID 2452 wrote to memory of 2668 2452 sample.exe Explorer.exe PID 2452 wrote to memory of 2668 2452 sample.exe Explorer.exe PID 2452 wrote to memory of 2668 2452 sample.exe Explorer.exe PID 2452 wrote to memory of 2668 2452 sample.exe Explorer.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\sample.exe"C:\Users\Admin\AppData\Local\Temp\sample.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Explorer.exeExplorer.exe2⤵
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"1⤵
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\sample.exe"C:\Users\Admin\AppData\Local\Temp\sample.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\sample.exe"C:\Users\Admin\AppData\Local\Temp\sample.exe"1⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2452-0-0x0000000000240000-0x0000000000247000-memory.dmpFilesize
28KB
-
memory/2668-1-0x00000000000D0000-0x0000000000101000-memory.dmpFilesize
196KB
-
memory/2668-2-0x00000000000D0000-0x0000000000101000-memory.dmpFilesize
196KB
-
memory/2668-3-0x0000000000220000-0x0000000000257000-memory.dmpFilesize
220KB
-
memory/2668-6-0x0000000000220000-0x0000000000257000-memory.dmpFilesize
220KB
-
memory/2668-7-0x0000000000220000-0x0000000000257000-memory.dmpFilesize
220KB