d5d744e0f7984ec01593da35f26bf24e95e4b1cc8bd1c0ff4f31de5dbf94e38f

Resubmissions

02/11/2020, 09:26

01/11/2020, 18:55

Target

d5d744e0f7984ec01593da35f26bf24e95e4b1cc8bd1c0ff4f31de5dbf94e38f.bin.sample.exe
Size

133KB
MD5

ba59b52b445f45aaf8fb707445587b48
SHA1

4d8a885624f580a3578026acae4f0bd53032db5d
SHA256

d5d744e0f7984ec01593da35f26bf24e95e4b1cc8bd1c0ff4f31de5dbf94e38f
SHA512

be951dca8946e187aacc86ef16fa319e6524191286316e3f387d21b1797f92dea6aa0f37ae47efd60f5fb7ccb342135049bb3753bbb35941438f6a690bae3137

Score

8^/10

Executes dropped EXE 2 IoCs

pid	Process
1708	HEhboKaNVlan.exe
1076	bKHzkhtlVlan.exe

Loads dropped DLL 4 IoCs

pid	Process
2012	d5d744e0f7984ec01593da35f26bf24e95e4b1cc8bd1c0ff4f31de5dbf94e38f.bin.sample.exe
2012	d5d744e0f7984ec01593da35f26bf24e95e4b1cc8bd1c0ff4f31de5dbf94e38f.bin.sample.exe
2012	d5d744e0f7984ec01593da35f26bf24e95e4b1cc8bd1c0ff4f31de5dbf94e38f.bin.sample.exe
2012	d5d744e0f7984ec01593da35f26bf24e95e4b1cc8bd1c0ff4f31de5dbf94e38f.bin.sample.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2012 wrote to memory of 1708	2012	d5d744e0f7984ec01593da35f26bf24e95e4b1cc8bd1c0ff4f31de5dbf94e38f.bin.sample.exe	29
PID 2012 wrote to memory of 1708	2012	d5d744e0f7984ec01593da35f26bf24e95e4b1cc8bd1c0ff4f31de5dbf94e38f.bin.sample.exe	29
PID 2012 wrote to memory of 1708	2012	d5d744e0f7984ec01593da35f26bf24e95e4b1cc8bd1c0ff4f31de5dbf94e38f.bin.sample.exe	29
PID 2012 wrote to memory of 1708	2012	d5d744e0f7984ec01593da35f26bf24e95e4b1cc8bd1c0ff4f31de5dbf94e38f.bin.sample.exe	29
PID 2012 wrote to memory of 1076	2012	d5d744e0f7984ec01593da35f26bf24e95e4b1cc8bd1c0ff4f31de5dbf94e38f.bin.sample.exe	30
PID 2012 wrote to memory of 1076	2012	d5d744e0f7984ec01593da35f26bf24e95e4b1cc8bd1c0ff4f31de5dbf94e38f.bin.sample.exe	30
PID 2012 wrote to memory of 1076	2012	d5d744e0f7984ec01593da35f26bf24e95e4b1cc8bd1c0ff4f31de5dbf94e38f.bin.sample.exe	30
PID 2012 wrote to memory of 1076	2012	d5d744e0f7984ec01593da35f26bf24e95e4b1cc8bd1c0ff4f31de5dbf94e38f.bin.sample.exe	30

C:\Users\Admin\AppData\Local\Temp\d5d744e0f7984ec01593da35f26bf24e95e4b1cc8bd1c0ff4f31de5dbf94e38f.bin.sample.exe
"C:\Users\Admin\AppData\Local\Temp\d5d744e0f7984ec01593da35f26bf24e95e4b1cc8bd1c0ff4f31de5dbf94e38f.bin.sample.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2012
- C:\Users\Admin\AppData\Local\Temp\HEhboKaNVlan.exe
  "C:\Users\Admin\AppData\Local\Temp\HEhboKaNVlan.exe" 8 LAN
  2⤵
  - Executes dropped EXE
  PID:1708
- C:\Users\Admin\AppData\Local\Temp\bKHzkhtlVlan.exe
  "C:\Users\Admin\AppData\Local\Temp\bKHzkhtlVlan.exe" 8 LAN
  2⤵
  - Executes dropped EXE
  PID:1076