bacf6241f87c53c797dc186155b4fdab8f9ec00c9d5f4d4a8b097299a35ccadd

Analysis

max time kernel
57s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 06:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bacf6241f87c53c797dc186155b4fdab8f9ec00c9d5f4d4a8b097299a35ccadd.exe
Size

73KB
MD5

a90251f5d9afcf62d3288d6b6d35f754
SHA1

dc4fdec28bb25bee51d3e425c828e02b3fa57337
SHA256

bacf6241f87c53c797dc186155b4fdab8f9ec00c9d5f4d4a8b097299a35ccadd
SHA512

4581e55f1b230ea088d83d7b6b340e15f70951e5a391d0a40beda5b664d9e9e1fd35d5581df23a97f86ccefde9e1e6d162d46fabce44a713753a6b6911a542f3
SSDEEP

1536:Hbws74jztoWoiK5QPqfhVWbdsmA+RjPFLC+e5he0ZGUGf2g:HQjJoViNPqfcxA+HFsheOg

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
764	[email protected]

Loads dropped DLL 2 IoCs

pid	Process
860	cmd.exe
860	cmd.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1992 wrote to memory of 860	1992	bacf6241f87c53c797dc186155b4fdab8f9ec00c9d5f4d4a8b097299a35ccadd.exe	29
PID 1992 wrote to memory of 860	1992	bacf6241f87c53c797dc186155b4fdab8f9ec00c9d5f4d4a8b097299a35ccadd.exe	29
PID 1992 wrote to memory of 860	1992	bacf6241f87c53c797dc186155b4fdab8f9ec00c9d5f4d4a8b097299a35ccadd.exe	29
PID 1992 wrote to memory of 860	1992	bacf6241f87c53c797dc186155b4fdab8f9ec00c9d5f4d4a8b097299a35ccadd.exe	29
PID 860 wrote to memory of 764	860	cmd.exe	30
PID 860 wrote to memory of 764	860	cmd.exe	30
PID 860 wrote to memory of 764	860	cmd.exe	30
PID 860 wrote to memory of 764	860	cmd.exe	30
PID 764 wrote to memory of 1248	764	[email protected]	31
PID 764 wrote to memory of 1248	764	[email protected]	31
PID 764 wrote to memory of 1248	764	[email protected]	31
PID 764 wrote to memory of 1248	764	[email protected]	31

C:\Users\Admin\AppData\Local\Temp\bacf6241f87c53c797dc186155b4fdab8f9ec00c9d5f4d4a8b097299a35ccadd.exe
"C:\Users\Admin\AppData\Local\Temp\bacf6241f87c53c797dc186155b4fdab8f9ec00c9d5f4d4a8b097299a35ccadd.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1992
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:860
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:764
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c 437190969.exe
      4⤵
      PID:1248

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
73KB

MD5
431e816a7ba834d75c05c7a039130b79

SHA1
04d3c83226544677f36a71e3e1df700cfda79429

SHA256
15bc3b2005450e1aafab1aad474fc50978458cae1593334334f89e847cfe3220

SHA512
ccf0c3844550640cab9abf9b3a5cf64b244fb460001c1afa9e2ad1035a2173e357746aa118434619f31f85a41b360f1c4e26c9b85aa4097cd221b598aba69135

Download Submit
C:\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
73KB

MD5
431e816a7ba834d75c05c7a039130b79

SHA1
04d3c83226544677f36a71e3e1df700cfda79429

SHA256
15bc3b2005450e1aafab1aad474fc50978458cae1593334334f89e847cfe3220

SHA512
ccf0c3844550640cab9abf9b3a5cf64b244fb460001c1afa9e2ad1035a2173e357746aa118434619f31f85a41b360f1c4e26c9b85aa4097cd221b598aba69135

Download Submit
\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
73KB

MD5
431e816a7ba834d75c05c7a039130b79

SHA1
04d3c83226544677f36a71e3e1df700cfda79429

SHA256
15bc3b2005450e1aafab1aad474fc50978458cae1593334334f89e847cfe3220

SHA512
ccf0c3844550640cab9abf9b3a5cf64b244fb460001c1afa9e2ad1035a2173e357746aa118434619f31f85a41b360f1c4e26c9b85aa4097cd221b598aba69135

Download Submit
\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
73KB

MD5
431e816a7ba834d75c05c7a039130b79

SHA1
04d3c83226544677f36a71e3e1df700cfda79429

SHA256
15bc3b2005450e1aafab1aad474fc50978458cae1593334334f89e847cfe3220

SHA512
ccf0c3844550640cab9abf9b3a5cf64b244fb460001c1afa9e2ad1035a2173e357746aa118434619f31f85a41b360f1c4e26c9b85aa4097cd221b598aba69135

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads