24870dbe2915912f3bae0d87d28c2c7b0ca699b883f5e79360081432dd8201d9

Analysis

max time kernel
150s
max time network
105s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 14:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

24870dbe2915912f3bae0d87d28c2c7b0ca699b883f5e79360081432dd8201d9.exe
Size

116KB
MD5

bc7c7375c741603806344284db750dbe
SHA1

a5f7c1f92769beaa808b715f63876dfefdc33c7e
SHA256

24870dbe2915912f3bae0d87d28c2c7b0ca699b883f5e79360081432dd8201d9
SHA512

604ffbf88c57fb9e5aba6287cedb072e2b4b79a414a8364d70e9abceac95ca8c5bee9edd4a366d795ab3f2986cb5c865d94ae1a0d1d3ae6ec38fdd25e4015cd2
SSDEEP

1536:8KbYAgFmKjc+AK2pgRzFr4/EK+1pV05vxvZ69FgxtBdBpvP+ohj6mQQ:8KCFNZjMgPr81+a5vxvZsFEjtOomQ

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

Winhlp31.exe

pid process

1372 Winhlp31.exe

pid	process
1372	Winhlp31.exe

Loads dropped DLL 2 IoCs

Processes:

24870dbe2915912f3bae0d87d28c2c7b0ca699b883f5e79360081432dd8201d9.exe

pid	process
1324	24870dbe2915912f3bae0d87d28c2c7b0ca699b883f5e79360081432dd8201d9.exe
1324	24870dbe2915912f3bae0d87d28c2c7b0ca699b883f5e79360081432dd8201d9.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

24870dbe2915912f3bae0d87d28c2c7b0ca699b883f5e79360081432dd8201d9.exeWinhlp31.exe

pid process

1324 24870dbe2915912f3bae0d87d28c2c7b0ca699b883f5e79360081432dd8201d9.exe
1372 Winhlp31.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

24870dbe2915912f3bae0d87d28c2c7b0ca699b883f5e79360081432dd8201d9.exe

description	pid	process	target process
PID 1324 wrote to memory of 1372	1324	24870dbe2915912f3bae0d87d28c2c7b0ca699b883f5e79360081432dd8201d9.exe	Winhlp31.exe
PID 1324 wrote to memory of 1372	1324	24870dbe2915912f3bae0d87d28c2c7b0ca699b883f5e79360081432dd8201d9.exe	Winhlp31.exe
PID 1324 wrote to memory of 1372	1324	24870dbe2915912f3bae0d87d28c2c7b0ca699b883f5e79360081432dd8201d9.exe	Winhlp31.exe
PID 1324 wrote to memory of 1372	1324	24870dbe2915912f3bae0d87d28c2c7b0ca699b883f5e79360081432dd8201d9.exe	Winhlp31.exe

C:\Users\Admin\AppData\Local\Temp\24870dbe2915912f3bae0d87d28c2c7b0ca699b883f5e79360081432dd8201d9.exe
"C:\Users\Admin\AppData\Local\Temp\24870dbe2915912f3bae0d87d28c2c7b0ca699b883f5e79360081432dd8201d9.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1324

C:\Users\Admin\Documents\CommonData\Winhlp31.exe
C:\Users\Admin\Documents\CommonData\Winhlp31.exe C:\Users\Admin\AppData\Local\Temp\24870dbe2915912f3bae0d87d28c2c7b0ca699b883f5e79360081432dd8201d9.exe
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1372

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\Documents\CommonData\Winhlp31.exe

Filesize
116KB

MD5
bc7c7375c741603806344284db750dbe

SHA1
a5f7c1f92769beaa808b715f63876dfefdc33c7e

SHA256
24870dbe2915912f3bae0d87d28c2c7b0ca699b883f5e79360081432dd8201d9

SHA512
604ffbf88c57fb9e5aba6287cedb072e2b4b79a414a8364d70e9abceac95ca8c5bee9edd4a366d795ab3f2986cb5c865d94ae1a0d1d3ae6ec38fdd25e4015cd2

Download Submit
\Users\Admin\Documents\CommonData\Winhlp31.exe

Filesize
116KB

MD5
bc7c7375c741603806344284db750dbe

SHA1
a5f7c1f92769beaa808b715f63876dfefdc33c7e

SHA256
24870dbe2915912f3bae0d87d28c2c7b0ca699b883f5e79360081432dd8201d9

SHA512
604ffbf88c57fb9e5aba6287cedb072e2b4b79a414a8364d70e9abceac95ca8c5bee9edd4a366d795ab3f2986cb5c865d94ae1a0d1d3ae6ec38fdd25e4015cd2

Download Submit
\Users\Admin\Documents\CommonData\Winhlp31.exe

Filesize
116KB

MD5
bc7c7375c741603806344284db750dbe

SHA1
a5f7c1f92769beaa808b715f63876dfefdc33c7e

SHA256
24870dbe2915912f3bae0d87d28c2c7b0ca699b883f5e79360081432dd8201d9

SHA512
604ffbf88c57fb9e5aba6287cedb072e2b4b79a414a8364d70e9abceac95ca8c5bee9edd4a366d795ab3f2986cb5c865d94ae1a0d1d3ae6ec38fdd25e4015cd2

Download Submit
memory/1324-54-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1324-55-0x0000000075AC1000-0x0000000075AC3000-memory.dmp

Filesize
8KB

Download
memory/1324-56-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1324-61-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1372-59-0x0000000000000000-mapping.dmp

Download
memory/1372-62-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1372-64-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download