Analysis
-
max time kernel
42s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
10/09/2022, 18:19
Behavioral task
behavioral1
Sample
doubletrouble.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
doubletrouble.exe
Resource
win10v2004-20220901-en
General
-
Target
doubletrouble.exe
-
Size
6.9MB
-
MD5
6d75553fa1aa48cc40d34123382f43fe
-
SHA1
75909fcdcba065a23b9733b8c13ab10bb0bdb8a6
-
SHA256
b162f02efbadb2f5d6fd7ec434eb830d6f420aa92a530ed8afc874fb1eef7568
-
SHA512
4f696881ffa6bd2e4aac58f8e1171121b3bbe82911cc7737d8c49ffbe9192a09c706ca51a618af7be53c7ee5135a06778795e9f265829bb7fb0bab69d804db92
-
SSDEEP
196608:0YwZPL2Vmd6+D/Wc/f/+SNEBqglXJFf35AP4UC:hIL2Vmd6mOc/eRRdJFuhC
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 1084 doubletrouble.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1684 wrote to memory of 1084 1684 doubletrouble.exe 28 PID 1684 wrote to memory of 1084 1684 doubletrouble.exe 28 PID 1684 wrote to memory of 1084 1684 doubletrouble.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\doubletrouble.exe"C:\Users\Admin\AppData\Local\Temp\doubletrouble.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1684 -
C:\Users\Admin\AppData\Local\Temp\doubletrouble.exe"C:\Users\Admin\AppData\Local\Temp\doubletrouble.exe"2⤵
- Loads dropped DLL
PID:1084
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4.3MB
MD5c80b5cb43e5fe7948c3562c1fff1254e
SHA1f73cb1fb9445c96ecd56b984a1822e502e71ab9d
SHA256058925e4bbfcb460a3c00ec824b8390583baef0c780a7c7ff01d43d9eec45f20
SHA512faa97a9d5d2a0bf78123f19f8657c24921b907268938c26f79e1df6d667f7bee564259a3a11022e8629996406cda9fa00434bb2b1de3e10b9bddc59708dbad81
-
Filesize
4.3MB
MD5c80b5cb43e5fe7948c3562c1fff1254e
SHA1f73cb1fb9445c96ecd56b984a1822e502e71ab9d
SHA256058925e4bbfcb460a3c00ec824b8390583baef0c780a7c7ff01d43d9eec45f20
SHA512faa97a9d5d2a0bf78123f19f8657c24921b907268938c26f79e1df6d667f7bee564259a3a11022e8629996406cda9fa00434bb2b1de3e10b9bddc59708dbad81