Analysis
-
max time kernel
148s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
24-11-2022 03:52
Static task
static1
Behavioral task
behavioral1
Sample
1a3e0de303aa19ac6c32c96108727a5e81bf57bc373ebb7de694cd8f432df710.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
1a3e0de303aa19ac6c32c96108727a5e81bf57bc373ebb7de694cd8f432df710.exe
Resource
win10v2004-20220812-en
General
-
Target
1a3e0de303aa19ac6c32c96108727a5e81bf57bc373ebb7de694cd8f432df710.exe
-
Size
643KB
-
MD5
18a5805528c6b4e684a4817ec528eead
-
SHA1
c7bdad25a422baa26b43ad4169c62c15af7d1fdb
-
SHA256
1a3e0de303aa19ac6c32c96108727a5e81bf57bc373ebb7de694cd8f432df710
-
SHA512
c6b91b0c22a153edca16861bc27b46c2b6cb28090bdcabadab7d901c9ecc1d819185fecbaf4f3e294147d772372655782c2f73194f27f4b61b7e8c1c6d18317a
-
SSDEEP
12288:miyU0BFtvsPUkGXgDkmBxAJmKVg8zThh6XQ1HoOUAWfTq3N:UVXtyLGwDJkJxVVzXIIHokWfTq
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
svhest.exepid process 3836 svhest.exe -
Drops file in System32 directory 3 IoCs
Processes:
1a3e0de303aa19ac6c32c96108727a5e81bf57bc373ebb7de694cd8f432df710.exesvhest.exedescription ioc process File created C:\Windows\SysWOW64\svhest.exe 1a3e0de303aa19ac6c32c96108727a5e81bf57bc373ebb7de694cd8f432df710.exe File opened for modification C:\Windows\SysWOW64\svhest.exe 1a3e0de303aa19ac6c32c96108727a5e81bf57bc373ebb7de694cd8f432df710.exe File opened for modification C:\Windows\SysWOW64\svhest.exe svhest.exe -
Drops file in Windows directory 1 IoCs
Processes:
1a3e0de303aa19ac6c32c96108727a5e81bf57bc373ebb7de694cd8f432df710.exedescription ioc process File created C:\Windows\RAV2007.BAT 1a3e0de303aa19ac6c32c96108727a5e81bf57bc373ebb7de694cd8f432df710.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
1a3e0de303aa19ac6c32c96108727a5e81bf57bc373ebb7de694cd8f432df710.exedescription pid process target process PID 4468 wrote to memory of 5016 4468 1a3e0de303aa19ac6c32c96108727a5e81bf57bc373ebb7de694cd8f432df710.exe cmd.exe PID 4468 wrote to memory of 5016 4468 1a3e0de303aa19ac6c32c96108727a5e81bf57bc373ebb7de694cd8f432df710.exe cmd.exe PID 4468 wrote to memory of 5016 4468 1a3e0de303aa19ac6c32c96108727a5e81bf57bc373ebb7de694cd8f432df710.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1a3e0de303aa19ac6c32c96108727a5e81bf57bc373ebb7de694cd8f432df710.exe"C:\Users\Admin\AppData\Local\Temp\1a3e0de303aa19ac6c32c96108727a5e81bf57bc373ebb7de694cd8f432df710.exe"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Windows\RAV2007.BAT2⤵
-
C:\Windows\SysWOW64\svhest.exeC:\Windows\SysWOW64\svhest.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\RAV2007.BATFilesize
254B
MD5d94864eabb78275be904ddb4a4607c49
SHA1776020a48074d3b4fb28d3b81aa74d43a505dacc
SHA25655b6823b951a823d3d7f05f76b8ad904df37ecf6be1355c1060ced7bc37d57b2
SHA51289e9bdc768287508232e1866cdf94f75fe8c7eb860b2c13486f2cbac7624d9bee869de6f78ff1be5e4ec6bc5f5638aae5f5bb7b3fdce410577a6bd2d570b1156
-
C:\Windows\SysWOW64\svhest.exeFilesize
643KB
MD518a5805528c6b4e684a4817ec528eead
SHA1c7bdad25a422baa26b43ad4169c62c15af7d1fdb
SHA2561a3e0de303aa19ac6c32c96108727a5e81bf57bc373ebb7de694cd8f432df710
SHA512c6b91b0c22a153edca16861bc27b46c2b6cb28090bdcabadab7d901c9ecc1d819185fecbaf4f3e294147d772372655782c2f73194f27f4b61b7e8c1c6d18317a
-
C:\Windows\SysWOW64\svhest.exeFilesize
643KB
MD518a5805528c6b4e684a4817ec528eead
SHA1c7bdad25a422baa26b43ad4169c62c15af7d1fdb
SHA2561a3e0de303aa19ac6c32c96108727a5e81bf57bc373ebb7de694cd8f432df710
SHA512c6b91b0c22a153edca16861bc27b46c2b6cb28090bdcabadab7d901c9ecc1d819185fecbaf4f3e294147d772372655782c2f73194f27f4b61b7e8c1c6d18317a
-
memory/5016-134-0x0000000000000000-mapping.dmp