3590880c05fbe81759dbacc7715becc2da382bd20bafe80df2c8d0a3b8fba380

Analysis

max time kernel
45s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
20/10/2022, 00:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3590880c05fbe81759dbacc7715becc2da382bd20bafe80df2c8d0a3b8fba380.exe
Size

54KB
MD5

a0bb71f4b96cd59502cc5d4eee0c84d0
SHA1

d13916eaab0d2f0d0e644e3eb86600d71b027204
SHA256

3590880c05fbe81759dbacc7715becc2da382bd20bafe80df2c8d0a3b8fba380
SHA512

471034aaf83c95f24f4b171755b07133541214e068350b5173ebc2acf728a9aec0b643c681e8f44c8984152aad89cbb9e2ae1927b74da0467c687be3fca8f677
SSDEEP

1536:aW9UJ38LShvEBWEIgj3kx5FWIdmqz/Qmrzfx1dMO8yY:aW9UJMLSqBlFQx5bmqz4o3

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1156	sccbxenr.exe

Loads dropped DLL 2 IoCs

pid	Process
1600	3590880c05fbe81759dbacc7715becc2da382bd20bafe80df2c8d0a3b8fba380.exe
1600	3590880c05fbe81759dbacc7715becc2da382bd20bafe80df2c8d0a3b8fba380.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	\??\c:\windows\SysWOW64\sccbxenr.exe	3590880c05fbe81759dbacc7715becc2da382bd20bafe80df2c8d0a3b8fba380.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1600 wrote to memory of 1156	1600	3590880c05fbe81759dbacc7715becc2da382bd20bafe80df2c8d0a3b8fba380.exe	27
PID 1600 wrote to memory of 1156	1600	3590880c05fbe81759dbacc7715becc2da382bd20bafe80df2c8d0a3b8fba380.exe	27
PID 1600 wrote to memory of 1156	1600	3590880c05fbe81759dbacc7715becc2da382bd20bafe80df2c8d0a3b8fba380.exe	27
PID 1600 wrote to memory of 1156	1600	3590880c05fbe81759dbacc7715becc2da382bd20bafe80df2c8d0a3b8fba380.exe	27

C:\Users\Admin\AppData\Local\Temp\3590880c05fbe81759dbacc7715becc2da382bd20bafe80df2c8d0a3b8fba380.exe
"C:\Users\Admin\AppData\Local\Temp\3590880c05fbe81759dbacc7715becc2da382bd20bafe80df2c8d0a3b8fba380.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1600
- \??\c:\windows\SysWOW64\sccbxenr.exe
  c:\windows\system32\sccbxenr.exe
  2⤵
  - Executes dropped EXE
  PID:1156

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\sccbxenr.exe

Filesize
54KB

MD5
a0bb71f4b96cd59502cc5d4eee0c84d0

SHA1
d13916eaab0d2f0d0e644e3eb86600d71b027204

SHA256
3590880c05fbe81759dbacc7715becc2da382bd20bafe80df2c8d0a3b8fba380

SHA512
471034aaf83c95f24f4b171755b07133541214e068350b5173ebc2acf728a9aec0b643c681e8f44c8984152aad89cbb9e2ae1927b74da0467c687be3fca8f677

Download Submit
\??\c:\windows\syswow64\sccbxenr.exe

Filesize
54KB

MD5
a0bb71f4b96cd59502cc5d4eee0c84d0

SHA1
d13916eaab0d2f0d0e644e3eb86600d71b027204

SHA256
3590880c05fbe81759dbacc7715becc2da382bd20bafe80df2c8d0a3b8fba380

SHA512
471034aaf83c95f24f4b171755b07133541214e068350b5173ebc2acf728a9aec0b643c681e8f44c8984152aad89cbb9e2ae1927b74da0467c687be3fca8f677

Download Submit
\Windows\SysWOW64\sccbxenr.exe

Filesize
54KB

MD5
a0bb71f4b96cd59502cc5d4eee0c84d0

SHA1
d13916eaab0d2f0d0e644e3eb86600d71b027204

SHA256
3590880c05fbe81759dbacc7715becc2da382bd20bafe80df2c8d0a3b8fba380

SHA512
471034aaf83c95f24f4b171755b07133541214e068350b5173ebc2acf728a9aec0b643c681e8f44c8984152aad89cbb9e2ae1927b74da0467c687be3fca8f677

Download Submit
\Windows\SysWOW64\sccbxenr.exe

Filesize
54KB

MD5
a0bb71f4b96cd59502cc5d4eee0c84d0

SHA1
d13916eaab0d2f0d0e644e3eb86600d71b027204

SHA256
3590880c05fbe81759dbacc7715becc2da382bd20bafe80df2c8d0a3b8fba380

SHA512
471034aaf83c95f24f4b171755b07133541214e068350b5173ebc2acf728a9aec0b643c681e8f44c8984152aad89cbb9e2ae1927b74da0467c687be3fca8f677

Download Submit
memory/1156-60-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/1600-58-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads