f7ae9bdd03e5df038aad0e809dbf31a00ca5e3b6aec3960417e14d5da18fd373

Analysis

Target
OhGodAnETHlargementPill2.exe
Size 6.1MB
Sample210105-phgra5bvta
SHA256 f7ae9bdd03e5df038aad0e809dbf31a00ca5e3b6aec3960417e14d5da18fd373
MD5 bc56da0b4522302f1bb8506ad4f35be2
SHA1 aa93d34f9c2018090b5138f7b9ea974bf86aefff
SHA512 ef574f24841c25e6e5ed4483ef8e564115505e94748cfa227a0dd4a1545f7b2599ff6447bea34821b3cf70789b9ae84502588a48c677ad8c60836e887e40cf30
MD5 SHA1 SHA512

Score

8^/10

Executes dropped EXE 2 IoCs

pid	Process
2792	ETHlargementPill-r2.exe
4012	ETHlargementPill-r2.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4012	ETHlargementPill-r2.exe
4012	ETHlargementPill-r2.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4768 wrote to memory of 2792	4768	OhGodAnETHlargementPill2.exe	75
PID 4768 wrote to memory of 2792	4768	OhGodAnETHlargementPill2.exe	75
PID 4768 wrote to memory of 2792	4768	OhGodAnETHlargementPill2.exe	75
PID 2792 wrote to memory of 4012	2792	ETHlargementPill-r2.exe	77
PID 2792 wrote to memory of 4012	2792	ETHlargementPill-r2.exe	77
PID 2792 wrote to memory of 4012	2792	ETHlargementPill-r2.exe	77

C:\Users\Admin\AppData\Local\Temp\OhGodAnETHlargementPill2.exe
"C:\Users\Admin\AppData\Local\Temp\OhGodAnETHlargementPill2.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4768
- C:\Users\Admin\AppData\Local\Temp\RarSFX0\ETHlargementPill-r2.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\ETHlargementPill-r2.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2792
- - C:\Users\Admin\AppData\Local\Temp\RarSFX0\ETHlargementPill-r2.exe
    "C:\Users\Admin\AppData\Local\Temp\RarSFX0\ETHlargementPill-r2.exe" /VERYSILENT
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:4012

memory/4768-10-0x0000000004C30000-0x0000000004C31000-memory.dmp

Download