b9a4a402b66028b8474d5f7eba6ecdaf3dc368859727e1b2601a9d78cd70f42c

Analysis

max time kernel
163s
max time network
178s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
19/09/2022, 17:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b9a4a402b66028b8474d5f7eba6ecdaf3dc368859727e1b2601a9d78cd70f42c.exe
Size

263KB
MD5

f9ea075d944342de830dc253f6fb24c6
SHA1

e53bb8a526d972997eb98c77ab82dbc6c57fdb18
SHA256

b9a4a402b66028b8474d5f7eba6ecdaf3dc368859727e1b2601a9d78cd70f42c
SHA512

2215a40bee45cbc20470f02d1c3a9c36628dfb438c3b4d8e766d400faead78989db7f9e03d14e3dbbf8c20319160db6ab866e2db73b9b86e70807adfaea93b9b
SSDEEP

6144:c0O+v8S1GRHmLePA3+GwPp1ik3XIbMAZlxaFCIU:cF+v85GLAkyPp1ikYAAlJIU

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2548	com

Drops file in System32 directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\com\com	com
File created	C:\Windows\SysWOW64\com\com	b9a4a402b66028b8474d5f7eba6ecdaf3dc368859727e1b2601a9d78cd70f42c.exe
File opened for modification	C:\Windows\SysWOW64\com\com	b9a4a402b66028b8474d5f7eba6ecdaf3dc368859727e1b2601a9d78cd70f42c.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Delete.bat	b9a4a402b66028b8474d5f7eba6ecdaf3dc368859727e1b2601a9d78cd70f42c.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4480	1240	WerFault.exe	81
3444	2548	WerFault.exe	84

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1240 wrote to memory of 1040	1240	b9a4a402b66028b8474d5f7eba6ecdaf3dc368859727e1b2601a9d78cd70f42c.exe	87
PID 1240 wrote to memory of 1040	1240	b9a4a402b66028b8474d5f7eba6ecdaf3dc368859727e1b2601a9d78cd70f42c.exe	87
PID 1240 wrote to memory of 1040	1240	b9a4a402b66028b8474d5f7eba6ecdaf3dc368859727e1b2601a9d78cd70f42c.exe	87

C:\Users\Admin\AppData\Local\Temp\b9a4a402b66028b8474d5f7eba6ecdaf3dc368859727e1b2601a9d78cd70f42c.exe
"C:\Users\Admin\AppData\Local\Temp\b9a4a402b66028b8474d5f7eba6ecdaf3dc368859727e1b2601a9d78cd70f42c.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1240
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1240 -s 576
  2⤵
  - Program crash
  PID:4480
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\Delete.bat
  2⤵
  PID:1040

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1240 -ip 1240
1⤵
PID:4136

C:\Windows\SysWOW64\com\com
C:\Windows\SysWOW64\com\com
1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2548
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2548 -s 544
  2⤵
  - Program crash
  PID:3444

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 2548 -ip 2548
1⤵
PID:2296

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Delete.bat

Filesize
250B

MD5
44e2be8a3f48e81f5a9aca8b3fe61000

SHA1
4b54e5ab9064c56e6e34e2f50f1b280649d096c7

SHA256
3ca3d1b12061c843fb14f42604ab04ca48e5b24465d036576d15322f97fcbfc4

SHA512
914205cac32b14df6fca7b6412f5670307d669d2a5f3938ace8dae2642e0f8e45b81c351da07986162fb66dacc52bc4330e18d56437d165d4bbb30c474fa3b6d

Download Submit
C:\Windows\SysWOW64\Com\com

Filesize
263KB

MD5
f9ea075d944342de830dc253f6fb24c6

SHA1
e53bb8a526d972997eb98c77ab82dbc6c57fdb18

SHA256
b9a4a402b66028b8474d5f7eba6ecdaf3dc368859727e1b2601a9d78cd70f42c

SHA512
2215a40bee45cbc20470f02d1c3a9c36628dfb438c3b4d8e766d400faead78989db7f9e03d14e3dbbf8c20319160db6ab866e2db73b9b86e70807adfaea93b9b

Download Submit
C:\Windows\SysWOW64\com\com

Filesize
263KB

MD5
f9ea075d944342de830dc253f6fb24c6

SHA1
e53bb8a526d972997eb98c77ab82dbc6c57fdb18

SHA256
b9a4a402b66028b8474d5f7eba6ecdaf3dc368859727e1b2601a9d78cd70f42c

SHA512
2215a40bee45cbc20470f02d1c3a9c36628dfb438c3b4d8e766d400faead78989db7f9e03d14e3dbbf8c20319160db6ab866e2db73b9b86e70807adfaea93b9b

Download Submit
memory/1240-132-0x0000000000400000-0x00000000004F8000-memory.dmp

Filesize
992KB

Download
memory/1240-133-0x0000000000400000-0x00000000004F8000-memory.dmp

Filesize
992KB

Download
memory/1240-138-0x0000000000400000-0x00000000004F8000-memory.dmp

Filesize
992KB

Download
memory/1240-141-0x0000000000400000-0x00000000004F8000-memory.dmp

Filesize
992KB

Download
memory/2548-136-0x0000000000400000-0x00000000004F8000-memory.dmp

Filesize
992KB

Download
memory/2548-137-0x0000000000400000-0x00000000004F8000-memory.dmp

Filesize
992KB

Download
memory/2548-139-0x0000000000400000-0x00000000004F8000-memory.dmp

Filesize
992KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads