89edf5e0bb3c759e38f1287b8f68c96704c0dfa2bdeef7f6e6ab31e38296c9ec

Analysis

max time kernel
121s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
01/12/2022, 21:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

89edf5e0bb3c759e38f1287b8f68c96704c0dfa2bdeef7f6e6ab31e38296c9ec.exe
Size

97KB
MD5

5802287f486f719ffbea789e456c92ef
SHA1

10b5be3b882ec1a2bddb4f1e1e28184cf80394fe
SHA256

89edf5e0bb3c759e38f1287b8f68c96704c0dfa2bdeef7f6e6ab31e38296c9ec
SHA512

df3062babbca70f417903ddd13eca219e53b19ac22dbd7f2b446d7063083ed76b4ed6b385ea28d26f5cbee4f1733376d4528d381e5ab1ebc44cea727ba518d6b
SSDEEP

1536:GyDFusSx9qYMhdFHS8qdydo3nTzhYxJA+CwNUtBZVY9v8pr33egtOn9P/Up:Gy9S4jHS8q/3nTzePCwNUh4E9+gtO1Y

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
944	fcubctijus

Loads dropped DLL 2 IoCs

pid	Process
864	89edf5e0bb3c759e38f1287b8f68c96704c0dfa2bdeef7f6e6ab31e38296c9ec.exe
864	89edf5e0bb3c759e38f1287b8f68c96704c0dfa2bdeef7f6e6ab31e38296c9ec.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 864 wrote to memory of 944	864	89edf5e0bb3c759e38f1287b8f68c96704c0dfa2bdeef7f6e6ab31e38296c9ec.exe	28
PID 864 wrote to memory of 944	864	89edf5e0bb3c759e38f1287b8f68c96704c0dfa2bdeef7f6e6ab31e38296c9ec.exe	28
PID 864 wrote to memory of 944	864	89edf5e0bb3c759e38f1287b8f68c96704c0dfa2bdeef7f6e6ab31e38296c9ec.exe	28
PID 864 wrote to memory of 944	864	89edf5e0bb3c759e38f1287b8f68c96704c0dfa2bdeef7f6e6ab31e38296c9ec.exe	28

C:\Users\Admin\AppData\Local\Temp\89edf5e0bb3c759e38f1287b8f68c96704c0dfa2bdeef7f6e6ab31e38296c9ec.exe
"C:\Users\Admin\AppData\Local\Temp\89edf5e0bb3c759e38f1287b8f68c96704c0dfa2bdeef7f6e6ab31e38296c9ec.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:864
- \??\c:\users\admin\appdata\local\fcubctijus
  "C:\Users\Admin\AppData\Local\Temp\89edf5e0bb3c759e38f1287b8f68c96704c0dfa2bdeef7f6e6ab31e38296c9ec.exe" a -sc:\users\admin\appdata\local\temp\89edf5e0bb3c759e38f1287b8f68c96704c0dfa2bdeef7f6e6ab31e38296c9ec.exe
  2⤵
  - Executes dropped EXE
  PID:944

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\fcubctijus

Filesize
21.0MB

MD5
b0ebe350aeaae86d6f25abfc7fb8ac71

SHA1
f607540f0c2235cfa7f5ff4d420e67746541a0b5

SHA256
a904511a302cfc752dd361f74bf90245c83910d8e5a7092327ee62260e9fd053

SHA512
178862e596a6a04d0c101466f96501ed39575489135fdc3a6e485f27e01675580b59f8ed1ac6e3b13872d7e5f9533e6ca66ce7447fbcb823f4fb9f5aa04e577f

Download Submit
\Users\Admin\AppData\Local\fcubctijus

Filesize
21.0MB

MD5
b0ebe350aeaae86d6f25abfc7fb8ac71

SHA1
f607540f0c2235cfa7f5ff4d420e67746541a0b5

SHA256
a904511a302cfc752dd361f74bf90245c83910d8e5a7092327ee62260e9fd053

SHA512
178862e596a6a04d0c101466f96501ed39575489135fdc3a6e485f27e01675580b59f8ed1ac6e3b13872d7e5f9533e6ca66ce7447fbcb823f4fb9f5aa04e577f

Download Submit
\Users\Admin\AppData\Local\fcubctijus

Filesize
21.0MB

MD5
b0ebe350aeaae86d6f25abfc7fb8ac71

SHA1
f607540f0c2235cfa7f5ff4d420e67746541a0b5

SHA256
a904511a302cfc752dd361f74bf90245c83910d8e5a7092327ee62260e9fd053

SHA512
178862e596a6a04d0c101466f96501ed39575489135fdc3a6e485f27e01675580b59f8ed1ac6e3b13872d7e5f9533e6ca66ce7447fbcb823f4fb9f5aa04e577f

Download Submit
memory/864-54-0x0000000000400000-0x000000000044E2EC-memory.dmp

Filesize
312KB

Download
memory/864-55-0x0000000000400000-0x000000000044E2EC-memory.dmp

Filesize
312KB

Download
memory/864-57-0x0000000000240000-0x000000000028F000-memory.dmp

Filesize
316KB

Download
memory/944-61-0x0000000000400000-0x000000000044E2EC-memory.dmp

Filesize
312KB

Download
memory/944-62-0x0000000000400000-0x000000000044E2EC-memory.dmp

Filesize
312KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads