Analysis

  • max time kernel
    90s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30/10/2022, 12:12

General

  • Target

    b92cd003da07cf8638476af32529873079ddfec7e1dad218c243bc28557bfb5a.exe

  • Size

    73KB

  • MD5

    9381260b3dcc650882b530e394de4800

  • SHA1

    8d4a541dc99303aaf25fc53d87b30275f3604949

  • SHA256

    b92cd003da07cf8638476af32529873079ddfec7e1dad218c243bc28557bfb5a

  • SHA512

    fadad9eeb24180231b7070b7ad15b3fce8f540cffca0fc6680a7efe4ec87686b857ee8dbc47442c6489f3480aee581c9e6d1a91f3ab34e1eeb2aadfb653d4afd

  • SSDEEP

    1536:HbmbLgS+hK5QPqfhVWbdsmA+RjPFLC+e5hF0ZGUGf2g:HwgS+hNPqfcxA+HFshFOg

Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b92cd003da07cf8638476af32529873079ddfec7e1dad218c243bc28557bfb5a.exe
    "C:\Users\Admin\AppData\Local\Temp\b92cd003da07cf8638476af32529873079ddfec7e1dad218c243bc28557bfb5a.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4684
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c [email protected]
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:580
      • C:\Users\Admin\AppData\Local\Temp\[email protected]
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:2892
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c 00.exe
          4⤵
            PID:1504

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\[email protected]

      Filesize

      73KB

      MD5

      b0dfef1c352488726b317bb421501a39

      SHA1

      bfb9840c5f1806f1027184add0b6a8bcbc04cd79

      SHA256

      8024633d989ba71cc98e3716be64997904e062939675179d5c185cd85a8a8272

      SHA512

      5127877435b9ccef2287b8ff29bfc9ac3a5d8693ff6fe91cbf82c4938141daa53202530ba04a191ac74746d3c2602bbb2a2d868e0521eae349eb3512455b336b

    • C:\Users\Admin\AppData\Local\Temp\[email protected]

      Filesize

      73KB

      MD5

      b0dfef1c352488726b317bb421501a39

      SHA1

      bfb9840c5f1806f1027184add0b6a8bcbc04cd79

      SHA256

      8024633d989ba71cc98e3716be64997904e062939675179d5c185cd85a8a8272

      SHA512

      5127877435b9ccef2287b8ff29bfc9ac3a5d8693ff6fe91cbf82c4938141daa53202530ba04a191ac74746d3c2602bbb2a2d868e0521eae349eb3512455b336b

    • C:\Users\Admin\AppData\Local\Temp\00.exe

      Filesize

      2KB

      MD5

      7b621943a35e7f39cf89f50cc48d7b94

      SHA1

      2858a28cf60f38025fffcd0ba2ecfec8511c197d

      SHA256

      bef04c2f89dc115ce2763558933dba1767bf30cda6856d335ae68955923f9991

      SHA512

      4169e664ad4e7e6891a05ceed78465e0ec44879b37fc0de97c014945e10c161f6bfb040efc24edc136e69bb115b2a1327b04cefb58141f712da856129872e8f1