b92cd003da07cf8638476af32529873079ddfec7e1dad218c243bc28557bfb5a

Analysis

max time kernel
43s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
30/10/2022, 12:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b92cd003da07cf8638476af32529873079ddfec7e1dad218c243bc28557bfb5a.exe
Size

73KB
MD5

9381260b3dcc650882b530e394de4800
SHA1

8d4a541dc99303aaf25fc53d87b30275f3604949
SHA256

b92cd003da07cf8638476af32529873079ddfec7e1dad218c243bc28557bfb5a
SHA512

fadad9eeb24180231b7070b7ad15b3fce8f540cffca0fc6680a7efe4ec87686b857ee8dbc47442c6489f3480aee581c9e6d1a91f3ab34e1eeb2aadfb653d4afd
SSDEEP

1536:HbmbLgS+hK5QPqfhVWbdsmA+RjPFLC+e5hF0ZGUGf2g:HwgS+hNPqfcxA+HFshFOg

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1992	[email protected]

Loads dropped DLL 2 IoCs

pid	Process
1648	cmd.exe
1648	cmd.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1492 wrote to memory of 1648	1492	b92cd003da07cf8638476af32529873079ddfec7e1dad218c243bc28557bfb5a.exe	28
PID 1492 wrote to memory of 1648	1492	b92cd003da07cf8638476af32529873079ddfec7e1dad218c243bc28557bfb5a.exe	28
PID 1492 wrote to memory of 1648	1492	b92cd003da07cf8638476af32529873079ddfec7e1dad218c243bc28557bfb5a.exe	28
PID 1492 wrote to memory of 1648	1492	b92cd003da07cf8638476af32529873079ddfec7e1dad218c243bc28557bfb5a.exe	28
PID 1648 wrote to memory of 1992	1648	cmd.exe	29
PID 1648 wrote to memory of 1992	1648	cmd.exe	29
PID 1648 wrote to memory of 1992	1648	cmd.exe	29
PID 1648 wrote to memory of 1992	1648	cmd.exe	29
PID 1992 wrote to memory of 1952	1992	[email protected]	30
PID 1992 wrote to memory of 1952	1992	[email protected]	30
PID 1992 wrote to memory of 1952	1992	[email protected]	30
PID 1992 wrote to memory of 1952	1992	[email protected]	30

C:\Users\Admin\AppData\Local\Temp\b92cd003da07cf8638476af32529873079ddfec7e1dad218c243bc28557bfb5a.exe
"C:\Users\Admin\AppData\Local\Temp\b92cd003da07cf8638476af32529873079ddfec7e1dad218c243bc28557bfb5a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1492
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1648
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1992
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c 00.exe
      4⤵
      PID:1952

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
73KB

MD5
b0dfef1c352488726b317bb421501a39

SHA1
bfb9840c5f1806f1027184add0b6a8bcbc04cd79

SHA256
8024633d989ba71cc98e3716be64997904e062939675179d5c185cd85a8a8272

SHA512
5127877435b9ccef2287b8ff29bfc9ac3a5d8693ff6fe91cbf82c4938141daa53202530ba04a191ac74746d3c2602bbb2a2d868e0521eae349eb3512455b336b

Download Submit
C:\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
73KB

MD5
b0dfef1c352488726b317bb421501a39

SHA1
bfb9840c5f1806f1027184add0b6a8bcbc04cd79

SHA256
8024633d989ba71cc98e3716be64997904e062939675179d5c185cd85a8a8272

SHA512
5127877435b9ccef2287b8ff29bfc9ac3a5d8693ff6fe91cbf82c4938141daa53202530ba04a191ac74746d3c2602bbb2a2d868e0521eae349eb3512455b336b

Download Submit
\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
73KB

MD5
b0dfef1c352488726b317bb421501a39

SHA1
bfb9840c5f1806f1027184add0b6a8bcbc04cd79

SHA256
8024633d989ba71cc98e3716be64997904e062939675179d5c185cd85a8a8272

SHA512
5127877435b9ccef2287b8ff29bfc9ac3a5d8693ff6fe91cbf82c4938141daa53202530ba04a191ac74746d3c2602bbb2a2d868e0521eae349eb3512455b336b

Download Submit
\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
73KB

MD5
b0dfef1c352488726b317bb421501a39

SHA1
bfb9840c5f1806f1027184add0b6a8bcbc04cd79

SHA256
8024633d989ba71cc98e3716be64997904e062939675179d5c185cd85a8a8272

SHA512
5127877435b9ccef2287b8ff29bfc9ac3a5d8693ff6fe91cbf82c4938141daa53202530ba04a191ac74746d3c2602bbb2a2d868e0521eae349eb3512455b336b

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads