b9a4a402b66028b8474d5f7eba6ecdaf3dc368859727e1b2601a9d78cd70f42c

Analysis

max time kernel
44s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
19/09/2022, 17:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b9a4a402b66028b8474d5f7eba6ecdaf3dc368859727e1b2601a9d78cd70f42c.exe
Size

263KB
MD5

f9ea075d944342de830dc253f6fb24c6
SHA1

e53bb8a526d972997eb98c77ab82dbc6c57fdb18
SHA256

b9a4a402b66028b8474d5f7eba6ecdaf3dc368859727e1b2601a9d78cd70f42c
SHA512

2215a40bee45cbc20470f02d1c3a9c36628dfb438c3b4d8e766d400faead78989db7f9e03d14e3dbbf8c20319160db6ab866e2db73b9b86e70807adfaea93b9b
SSDEEP

6144:c0O+v8S1GRHmLePA3+GwPp1ik3XIbMAZlxaFCIU:cF+v85GLAkyPp1ikYAAlJIU

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
276	com

Deletes itself 1 IoCs

pid	Process
1648	cmd.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\com\com	b9a4a402b66028b8474d5f7eba6ecdaf3dc368859727e1b2601a9d78cd70f42c.exe
File opened for modification	C:\Windows\SysWOW64\com\com	b9a4a402b66028b8474d5f7eba6ecdaf3dc368859727e1b2601a9d78cd70f42c.exe
File opened for modification	C:\Windows\SysWOW64\com\com	com

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Delete.bat	b9a4a402b66028b8474d5f7eba6ecdaf3dc368859727e1b2601a9d78cd70f42c.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1428 wrote to memory of 1648	1428	b9a4a402b66028b8474d5f7eba6ecdaf3dc368859727e1b2601a9d78cd70f42c.exe	29
PID 1428 wrote to memory of 1648	1428	b9a4a402b66028b8474d5f7eba6ecdaf3dc368859727e1b2601a9d78cd70f42c.exe	29
PID 1428 wrote to memory of 1648	1428	b9a4a402b66028b8474d5f7eba6ecdaf3dc368859727e1b2601a9d78cd70f42c.exe	29
PID 1428 wrote to memory of 1648	1428	b9a4a402b66028b8474d5f7eba6ecdaf3dc368859727e1b2601a9d78cd70f42c.exe	29

C:\Users\Admin\AppData\Local\Temp\b9a4a402b66028b8474d5f7eba6ecdaf3dc368859727e1b2601a9d78cd70f42c.exe
"C:\Users\Admin\AppData\Local\Temp\b9a4a402b66028b8474d5f7eba6ecdaf3dc368859727e1b2601a9d78cd70f42c.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1428
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Windows\Delete.bat
  2⤵
  - Deletes itself
  PID:1648

C:\Windows\SysWOW64\com\com
C:\Windows\SysWOW64\com\com
1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:276

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Delete.bat

Filesize
250B

MD5
44e2be8a3f48e81f5a9aca8b3fe61000

SHA1
4b54e5ab9064c56e6e34e2f50f1b280649d096c7

SHA256
3ca3d1b12061c843fb14f42604ab04ca48e5b24465d036576d15322f97fcbfc4

SHA512
914205cac32b14df6fca7b6412f5670307d669d2a5f3938ace8dae2642e0f8e45b81c351da07986162fb66dacc52bc4330e18d56437d165d4bbb30c474fa3b6d

Download Submit
C:\Windows\SysWOW64\com\com

Filesize
263KB

MD5
f9ea075d944342de830dc253f6fb24c6

SHA1
e53bb8a526d972997eb98c77ab82dbc6c57fdb18

SHA256
b9a4a402b66028b8474d5f7eba6ecdaf3dc368859727e1b2601a9d78cd70f42c

SHA512
2215a40bee45cbc20470f02d1c3a9c36628dfb438c3b4d8e766d400faead78989db7f9e03d14e3dbbf8c20319160db6ab866e2db73b9b86e70807adfaea93b9b

Download Submit
C:\Windows\SysWOW64\com\com

Filesize
263KB

MD5
f9ea075d944342de830dc253f6fb24c6

SHA1
e53bb8a526d972997eb98c77ab82dbc6c57fdb18

SHA256
b9a4a402b66028b8474d5f7eba6ecdaf3dc368859727e1b2601a9d78cd70f42c

SHA512
2215a40bee45cbc20470f02d1c3a9c36628dfb438c3b4d8e766d400faead78989db7f9e03d14e3dbbf8c20319160db6ab866e2db73b9b86e70807adfaea93b9b

Download Submit
memory/276-59-0x0000000000400000-0x00000000004F8000-memory.dmp

Filesize
992KB

Download
memory/276-60-0x0000000000400000-0x00000000004F8000-memory.dmp

Filesize
992KB

Download
memory/276-62-0x0000000000400000-0x00000000004F8000-memory.dmp

Filesize
992KB

Download
memory/1428-54-0x0000000076261000-0x0000000076263000-memory.dmp

Filesize
8KB

Download
memory/1428-55-0x0000000000400000-0x00000000004F8000-memory.dmp

Filesize
992KB

Download
memory/1428-56-0x0000000000400000-0x00000000004F8000-memory.dmp

Filesize
992KB

Download
memory/1428-64-0x0000000000400000-0x00000000004F8000-memory.dmp

Filesize
992KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads