eae8c9393b3f9b8e5e6d627819859b38f544bf739149bed0f57f49e4fd684fe6

Analysis

max time kernel
39s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
02/10/2022, 05:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eae8c9393b3f9b8e5e6d627819859b38f544bf739149bed0f57f49e4fd684fe6.exe
Size

363KB
MD5

6eb8d193b78808d1a1e20750e16bfebd
SHA1

4f201ac03b451221a529016f48e7b13c9b6fd907
SHA256

eae8c9393b3f9b8e5e6d627819859b38f544bf739149bed0f57f49e4fd684fe6
SHA512

3e29ee5850b7099971e814d8e0161cbddf895d227b0e75b0c8bcb8dab2c60ee131d0a2aa59c4f7985f49a59903259871052b1ea0258fa9cc62617d3d6d488bc1
SSDEEP

6144:+yH7xOc6H5c6HcT66vlmB4+2ChJ2K2pVRJQEhycgNol0ThF/b5M8G+QsRrnOa:+axTChchyZj/btG+QsRx

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
1948	svchost.exe
1436	eae8c9393b3f9b8e5e6d627819859b38f544bf739149bed0f57f49e4fd684fe6.exe
1920	svchost.exe

Loads dropped DLL 4 IoCs

pid	Process
1948	svchost.exe
1436	eae8c9393b3f9b8e5e6d627819859b38f544bf739149bed0f57f49e4fd684fe6.exe
1436	eae8c9393b3f9b8e5e6d627819859b38f544bf739149bed0f57f49e4fd684fe6.exe
1436	eae8c9393b3f9b8e5e6d627819859b38f544bf739149bed0f57f49e4fd684fe6.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\svchost.exe	eae8c9393b3f9b8e5e6d627819859b38f544bf739149bed0f57f49e4fd684fe6.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1436	eae8c9393b3f9b8e5e6d627819859b38f544bf739149bed0f57f49e4fd684fe6.exe
1436	eae8c9393b3f9b8e5e6d627819859b38f544bf739149bed0f57f49e4fd684fe6.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1956 wrote to memory of 1948	1956	eae8c9393b3f9b8e5e6d627819859b38f544bf739149bed0f57f49e4fd684fe6.exe	28
PID 1956 wrote to memory of 1948	1956	eae8c9393b3f9b8e5e6d627819859b38f544bf739149bed0f57f49e4fd684fe6.exe	28
PID 1956 wrote to memory of 1948	1956	eae8c9393b3f9b8e5e6d627819859b38f544bf739149bed0f57f49e4fd684fe6.exe	28
PID 1956 wrote to memory of 1948	1956	eae8c9393b3f9b8e5e6d627819859b38f544bf739149bed0f57f49e4fd684fe6.exe	28
PID 1956 wrote to memory of 1948	1956	eae8c9393b3f9b8e5e6d627819859b38f544bf739149bed0f57f49e4fd684fe6.exe	28
PID 1956 wrote to memory of 1948	1956	eae8c9393b3f9b8e5e6d627819859b38f544bf739149bed0f57f49e4fd684fe6.exe	28
PID 1956 wrote to memory of 1948	1956	eae8c9393b3f9b8e5e6d627819859b38f544bf739149bed0f57f49e4fd684fe6.exe	28
PID 1948 wrote to memory of 1436	1948	svchost.exe	29
PID 1948 wrote to memory of 1436	1948	svchost.exe	29
PID 1948 wrote to memory of 1436	1948	svchost.exe	29
PID 1948 wrote to memory of 1436	1948	svchost.exe	29
PID 1948 wrote to memory of 1436	1948	svchost.exe	29
PID 1948 wrote to memory of 1436	1948	svchost.exe	29
PID 1948 wrote to memory of 1436	1948	svchost.exe	29

C:\Users\Admin\AppData\Local\Temp\eae8c9393b3f9b8e5e6d627819859b38f544bf739149bed0f57f49e4fd684fe6.exe
"C:\Users\Admin\AppData\Local\Temp\eae8c9393b3f9b8e5e6d627819859b38f544bf739149bed0f57f49e4fd684fe6.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1956
- C:\Windows\svchost.exe
  "C:\Windows\svchost.exe" "C:\Users\Admin\AppData\Local\Temp\eae8c9393b3f9b8e5e6d627819859b38f544bf739149bed0f57f49e4fd684fe6.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1948
- - C:\Users\Admin\AppData\Local\Temp\eae8c9393b3f9b8e5e6d627819859b38f544bf739149bed0f57f49e4fd684fe6.exe
    "C:\Users\Admin\AppData\Local\Temp\eae8c9393b3f9b8e5e6d627819859b38f544bf739149bed0f57f49e4fd684fe6.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1436

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
- Executes dropped EXE
PID:1920

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\eae8c9393b3f9b8e5e6d627819859b38f544bf739149bed0f57f49e4fd684fe6.exe

Filesize
328KB

MD5
f0e12ee7d85096a6c5b5e0109158610c

SHA1
8f53918126f7e4f7f3909a6ecec8181f9b787ba4

SHA256
c52c1821ccb50a5c1445aadda5e9208a0169c51bca5ce2d23a1d39e1c4aa8afa

SHA512
1ac5459bf970dd1b1ca336e5750582a74d095a51d5a6140711fac650d865728362a43e434b56dd6cda3cd76cddb571c30c23ed4ce63ff97e83aa0dad797b457c

Download Submit
C:\Users\Admin\AppData\Local\Temp\eae8c9393b3f9b8e5e6d627819859b38f544bf739149bed0f57f49e4fd684fe6.exe

Filesize
328KB

MD5
f0e12ee7d85096a6c5b5e0109158610c

SHA1
8f53918126f7e4f7f3909a6ecec8181f9b787ba4

SHA256
c52c1821ccb50a5c1445aadda5e9208a0169c51bca5ce2d23a1d39e1c4aa8afa

SHA512
1ac5459bf970dd1b1ca336e5750582a74d095a51d5a6140711fac650d865728362a43e434b56dd6cda3cd76cddb571c30c23ed4ce63ff97e83aa0dad797b457c

Download Submit
C:\Windows\svchost.exe

Filesize
35KB

MD5
9e3c13b6556d5636b745d3e466d47467

SHA1
2ac1c19e268c49bc508f83fe3d20f495deb3e538

SHA256
20af03add533a6870d524a7c4753b42bfceb56cddd46016c051e23581ba743f8

SHA512
5a07ba8a7fcb15f64b129fada2621252b8bc37eb34d4f614c075c064f8ac0d367301eba0c32c5e28b8aa633f6ab604f0dfcc363b34734ce0207ef0d4e8817c4b

Download Submit
C:\Windows\svchost.exe

Filesize
35KB

MD5
9e3c13b6556d5636b745d3e466d47467

SHA1
2ac1c19e268c49bc508f83fe3d20f495deb3e538

SHA256
20af03add533a6870d524a7c4753b42bfceb56cddd46016c051e23581ba743f8

SHA512
5a07ba8a7fcb15f64b129fada2621252b8bc37eb34d4f614c075c064f8ac0d367301eba0c32c5e28b8aa633f6ab604f0dfcc363b34734ce0207ef0d4e8817c4b

Download Submit
C:\Windows\svchost.exe

Filesize
35KB

MD5
9e3c13b6556d5636b745d3e466d47467

SHA1
2ac1c19e268c49bc508f83fe3d20f495deb3e538

SHA256
20af03add533a6870d524a7c4753b42bfceb56cddd46016c051e23581ba743f8

SHA512
5a07ba8a7fcb15f64b129fada2621252b8bc37eb34d4f614c075c064f8ac0d367301eba0c32c5e28b8aa633f6ab604f0dfcc363b34734ce0207ef0d4e8817c4b

Download Submit
\Users\Admin\AppData\Local\Temp\eae8c9393b3f9b8e5e6d627819859b38f544bf739149bed0f57f49e4fd684fe6.exe

Filesize
328KB

MD5
f0e12ee7d85096a6c5b5e0109158610c

SHA1
8f53918126f7e4f7f3909a6ecec8181f9b787ba4

SHA256
c52c1821ccb50a5c1445aadda5e9208a0169c51bca5ce2d23a1d39e1c4aa8afa

SHA512
1ac5459bf970dd1b1ca336e5750582a74d095a51d5a6140711fac650d865728362a43e434b56dd6cda3cd76cddb571c30c23ed4ce63ff97e83aa0dad797b457c

Download Submit
\Users\Admin\AppData\Local\Temp\eae8c9393b3f9b8e5e6d627819859b38f544bf739149bed0f57f49e4fd684fe6.exe

Filesize
328KB

MD5
f0e12ee7d85096a6c5b5e0109158610c

SHA1
8f53918126f7e4f7f3909a6ecec8181f9b787ba4

SHA256
c52c1821ccb50a5c1445aadda5e9208a0169c51bca5ce2d23a1d39e1c4aa8afa

SHA512
1ac5459bf970dd1b1ca336e5750582a74d095a51d5a6140711fac650d865728362a43e434b56dd6cda3cd76cddb571c30c23ed4ce63ff97e83aa0dad797b457c

Download Submit
\Users\Admin\AppData\Local\Temp\eae8c9393b3f9b8e5e6d627819859b38f544bf739149bed0f57f49e4fd684fe6.exe

Filesize
328KB

MD5
f0e12ee7d85096a6c5b5e0109158610c

SHA1
8f53918126f7e4f7f3909a6ecec8181f9b787ba4

SHA256
c52c1821ccb50a5c1445aadda5e9208a0169c51bca5ce2d23a1d39e1c4aa8afa

SHA512
1ac5459bf970dd1b1ca336e5750582a74d095a51d5a6140711fac650d865728362a43e434b56dd6cda3cd76cddb571c30c23ed4ce63ff97e83aa0dad797b457c

Download Submit
\Users\Admin\AppData\Local\Temp\eae8c9393b3f9b8e5e6d627819859b38f544bf739149bed0f57f49e4fd684fe6.exe

Filesize
328KB

MD5
f0e12ee7d85096a6c5b5e0109158610c

SHA1
8f53918126f7e4f7f3909a6ecec8181f9b787ba4

SHA256
c52c1821ccb50a5c1445aadda5e9208a0169c51bca5ce2d23a1d39e1c4aa8afa

SHA512
1ac5459bf970dd1b1ca336e5750582a74d095a51d5a6140711fac650d865728362a43e434b56dd6cda3cd76cddb571c30c23ed4ce63ff97e83aa0dad797b457c

Download Submit
memory/1956-54-0x00000000762F1000-0x00000000762F3000-memory.dmp

Filesize
8KB

Download