f1731705c1c8639d16629e8a5eec4bc806d8946ee3225701726c6c5723c9af05

Analysis

max time kernel
262s
max time network
411s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
27-10-2022 03:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f1731705c1c8639d16629e8a5eec4bc806d8946ee3225701726c6c5723c9af05.exe
Size

222KB
MD5

48ad1e27068592e376e696dd1f5b8592
SHA1

ceaf79794fef1b453767ef6004067fe05ac0328a
SHA256

f1731705c1c8639d16629e8a5eec4bc806d8946ee3225701726c6c5723c9af05
SHA512

b360ec58ab2299f8529549633e0cdcad25655af3064ed4d6f9570d8cea66d8e72b6fc522c42c22fa4609637a75b865d04e50b036e432f7a3db00e3d09ad6be8d
SSDEEP

3072:auEyjDRl0gbL6ktlfQWs8FhmepNvhQPeQ0kwyRC4uYhbZiojAmc7Dbck0OBrOz8O:as0gbm0XsOme5y0SRZiojAFHNgQl6Us

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

6AB88636BA.exe

pid process

1780 6AB88636BA.exe

pid	process
1780	6AB88636BA.exe

Drops startup file 3 IoCs

Processes:

f1731705c1c8639d16629e8a5eec4bc806d8946ee3225701726c6c5723c9af05.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\6AB88636BA.exe	f1731705c1c8639d16629e8a5eec4bc806d8946ee3225701726c6c5723c9af05.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\6AB88636BA.exe	f1731705c1c8639d16629e8a5eec4bc806d8946ee3225701726c6c5723c9af05.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\6AB88636BA.exe:Zone.Identifier	f1731705c1c8639d16629e8a5eec4bc806d8946ee3225701726c6c5723c9af05.exe

Loads dropped DLL 2 IoCs

Processes:

f1731705c1c8639d16629e8a5eec4bc806d8946ee3225701726c6c5723c9af05.exe

pid	process
1112	f1731705c1c8639d16629e8a5eec4bc806d8946ee3225701726c6c5723c9af05.exe
1112	f1731705c1c8639d16629e8a5eec4bc806d8946ee3225701726c6c5723c9af05.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

f1731705c1c8639d16629e8a5eec4bc806d8946ee3225701726c6c5723c9af05.exe

description	pid	process	target process
PID 1112 wrote to memory of 1780	1112	f1731705c1c8639d16629e8a5eec4bc806d8946ee3225701726c6c5723c9af05.exe	6AB88636BA.exe
PID 1112 wrote to memory of 1780	1112	f1731705c1c8639d16629e8a5eec4bc806d8946ee3225701726c6c5723c9af05.exe	6AB88636BA.exe
PID 1112 wrote to memory of 1780	1112	f1731705c1c8639d16629e8a5eec4bc806d8946ee3225701726c6c5723c9af05.exe	6AB88636BA.exe
PID 1112 wrote to memory of 1780	1112	f1731705c1c8639d16629e8a5eec4bc806d8946ee3225701726c6c5723c9af05.exe	6AB88636BA.exe

C:\Users\Admin\AppData\Local\Temp\f1731705c1c8639d16629e8a5eec4bc806d8946ee3225701726c6c5723c9af05.exe
"C:\Users\Admin\AppData\Local\Temp\f1731705c1c8639d16629e8a5eec4bc806d8946ee3225701726c6c5723c9af05.exe"
1⤵
- Drops startup file
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1112

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\6AB88636BA.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\6AB88636BA.exe"
2⤵
- Executes dropped EXE
PID:1780

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\6AB88636BA.exe
Filesize
222KB

MD5
48ad1e27068592e376e696dd1f5b8592

SHA1
ceaf79794fef1b453767ef6004067fe05ac0328a

SHA256
f1731705c1c8639d16629e8a5eec4bc806d8946ee3225701726c6c5723c9af05

SHA512
b360ec58ab2299f8529549633e0cdcad25655af3064ed4d6f9570d8cea66d8e72b6fc522c42c22fa4609637a75b865d04e50b036e432f7a3db00e3d09ad6be8d

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\6AB88636BA.exe
Filesize
222KB

MD5
48ad1e27068592e376e696dd1f5b8592

SHA1
ceaf79794fef1b453767ef6004067fe05ac0328a

SHA256
f1731705c1c8639d16629e8a5eec4bc806d8946ee3225701726c6c5723c9af05

SHA512
b360ec58ab2299f8529549633e0cdcad25655af3064ed4d6f9570d8cea66d8e72b6fc522c42c22fa4609637a75b865d04e50b036e432f7a3db00e3d09ad6be8d

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\6AB88636BA.exe
Filesize
222KB

MD5
48ad1e27068592e376e696dd1f5b8592

SHA1
ceaf79794fef1b453767ef6004067fe05ac0328a

SHA256
f1731705c1c8639d16629e8a5eec4bc806d8946ee3225701726c6c5723c9af05

SHA512
b360ec58ab2299f8529549633e0cdcad25655af3064ed4d6f9570d8cea66d8e72b6fc522c42c22fa4609637a75b865d04e50b036e432f7a3db00e3d09ad6be8d

Download Submit
memory/1112-54-0x00000000002A6000-0x00000000002BB000-memory.dmp

Filesize
84KB

Download
memory/1112-55-0x0000000074D61000-0x0000000074D63000-memory.dmp

Filesize
8KB

Download
memory/1112-60-0x000000000028C000-0x00000000002A7000-memory.dmp

Filesize
108KB

Download
memory/1112-61-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/1780-58-0x0000000000000000-mapping.dmp

Download
memory/1780-62-0x00000000004F6000-0x000000000050B000-memory.dmp

Filesize
84KB

Download
memory/1780-64-0x00000000004DC000-0x00000000004F7000-memory.dmp

Filesize
108KB

Download
memory/1780-65-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/1780-66-0x00000000004DC000-0x00000000004F7000-memory.dmp

Filesize
108KB

Download