649c75d99b6d8e237d8a8d0142796fcbfa7381674628201f474b58039144ec2a

Submit
Reports

Overview

overview

Static

static

233f95c87f...31.exe

windows7-x64

233f95c87f...31.exe

windows10-2004-x64

2d8ea1230d...aa.exe

windows7-x64

2d8ea1230d...aa.exe

windows10-2004-x64

34dba85bb2...1a.exe

windows7-x64

34dba85bb2...1a.exe

windows10-2004-x64

463d0b0903...ea.exe

windows7-x64

463d0b0903...ea.exe

windows10-2004-x64

4bcf45bde8...39.exe

windows7-x64

4bcf45bde8...39.exe

windows10-2004-x64

5292b8004f...ce.exe

windows7-x64

5292b8004f...ce.exe

windows10-2004-x64

6babc5b52d...53.dll

windows7-x64

6babc5b52d...53.dll

windows10-2004-x64

85b73b7b3c...45.exe

windows7-x64

85b73b7b3c...45.exe

windows10-2004-x64

8eb41b097a...ff.exe

windows7-x64

8eb41b097a...ff.exe

windows10-2004-x64

932380926b...ef.exe

windows7-x64

932380926b...ef.exe

windows10-2004-x64

9d8729b9ca...de.exe

windows7-x64

9d8729b9ca...de.exe

windows10-2004-x64

9e147a3bb2...53.dll

windows7-x64

9e147a3bb2...53.dll

windows10-2004-x64

bccfdc8e1a...96.exe

windows7-x64

bccfdc8e1a...96.exe

windows10-2004-x64

bf5a9bb619...d7.exe

windows7-x64

bf5a9bb619...d7.exe

windows10-2004-x64

d0017384df...0a.exe

windows7-x64

d0017384df...0a.exe

windows10-2004-x64

d72aa8fe30...89.exe

windows7-x64

d72aa8fe30...89.exe

windows10-2004-x64

Resubmissions

15-11-2024 18:05

241115-wpjcdsxrdy 10

11-11-2024 21:40

241111-1h6xbsxcql 10

03-12-2022 17:54

221203-wg4ncscc33 10

Analysis

max time kernel
99s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03-12-2022 17:54

Sharing

Copy URL

Twitter E-mail

Static task

static1

vmprotect

1 signatures

Behavioral task

behavioral1

Sample

233f95c87f4930fc7608e264cf8be9d4ff0d5f073c411dc986c7aa8ac2055231.exe

Resource

win7-20220901-en

vmprotect

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral2

Sample

233f95c87f4930fc7608e264cf8be9d4ff0d5f073c411dc986c7aa8ac2055231.exe

Resource

win10v2004-20221111-en

vmprotect

windows10-2004-x64

1 signatures

150 seconds

Behavioral task

behavioral3

Sample

2d8ea1230d6d994febd35edec21f298efe7e1a2a6f75d00a691035980f30a5aa.exe

Resource

win7-20220812-en

raccoon bd3a3a503834ef8e836d8a99d1ecff54 stealer

windows7-x64

4 signatures

150 seconds

Behavioral task

behavioral4

Sample

2d8ea1230d6d994febd35edec21f298efe7e1a2a6f75d00a691035980f30a5aa.exe

Resource

win10v2004-20220812-en

raccoon bd3a3a503834ef8e836d8a99d1ecff54 stealer

windows10-2004-x64

4 signatures

150 seconds

Behavioral task

behavioral5

Sample

34dba85bb25c6589d0a5befe607e52b82a740402b92dbb5989797a523fb7561a.exe

Resource

win7-20220812-en

persistence

windows7-x64

4 signatures

150 seconds

Behavioral task

behavioral6

Sample

34dba85bb25c6589d0a5befe607e52b82a740402b92dbb5989797a523fb7561a.exe

Resource

win10v2004-20220812-en

persistence

windows10-2004-x64

4 signatures

150 seconds

Behavioral task

behavioral7

Sample

463d0b090396ffa05d579521256e421080a955415554feebe490482551eb08ea.exe

Resource

win7-20220901-en

windows7-x64

1 signatures

150 seconds

Behavioral task

behavioral8

Sample

463d0b090396ffa05d579521256e421080a955415554feebe490482551eb08ea.exe

Resource

win10v2004-20220812-en

windows10-2004-x64

1 signatures

150 seconds

Behavioral task

behavioral9

Sample

4bcf45bde8ef34c0afeea288098cf34da11c2748eead6cf4752db1a4a2e79c39.exe

Resource

win7-20220812-en

windows7-x64

0 signatures

150 seconds

Behavioral task

behavioral10

Sample

4bcf45bde8ef34c0afeea288098cf34da11c2748eead6cf4752db1a4a2e79c39.exe

Resource

win10v2004-20220812-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral11

Sample

5292b8004f9078cfddbb45f7a0a1d0e6c84a958e43e602f43f8af4161983b6ce.exe

Resource

win7-20220901-en

redline nam6.1 infostealer spyware

windows7-x64

8 signatures

150 seconds

Behavioral task

behavioral12

Sample

5292b8004f9078cfddbb45f7a0a1d0e6c84a958e43e602f43f8af4161983b6ce.exe

Resource

win10v2004-20220812-en

redline nam6.1 infostealer spyware

windows10-2004-x64

8 signatures

150 seconds

Behavioral task

behavioral13

Sample

6babc5b52d59c0b41e526f06b9e751aeef7ad6fc8b9eef5f56f95d4e3cded853.dll

Resource

win7-20220812-en

windows7-x64

1 signatures

150 seconds

Behavioral task

behavioral14

Sample

6babc5b52d59c0b41e526f06b9e751aeef7ad6fc8b9eef5f56f95d4e3cded853.dll

Resource

win10v2004-20220812-en

windows10-2004-x64

1 signatures

150 seconds

Behavioral task

behavioral15

Sample

85b73b7b3c9acc6648beb77ce878ebeea26a2a949bf17c3184f2bd4544d12b45.exe

Resource

win7-20220812-en

privateloader evasion loader main spyware stealer trojan

windows7-x64

17 signatures

150 seconds

Behavioral task

behavioral16

Sample

85b73b7b3c9acc6648beb77ce878ebeea26a2a949bf17c3184f2bd4544d12b45.exe

Resource

win10v2004-20220901-en

privateloader evasion loader main spyware stealer trojan

windows10-2004-x64

16 signatures

150 seconds

Behavioral task

behavioral17

Sample

8eb41b097a51665e2a51b7d055260ea06b5224123450a147080de0a0ebcb4fff.exe

Resource

win7-20221111-en

windows7-x64

10 signatures

150 seconds

Behavioral task

behavioral18

Sample

8eb41b097a51665e2a51b7d055260ea06b5224123450a147080de0a0ebcb4fff.exe

Resource

win10v2004-20220812-en

windows10-2004-x64

11 signatures

150 seconds

Behavioral task

behavioral19

Sample

932380926bc6bffcdf0bc446af37d140ce22426f651679e3b7d1c8fea83d14ef.exe

Resource

win7-20221111-en

windows7-x64

5 signatures

150 seconds

Behavioral task

behavioral20

Sample

932380926bc6bffcdf0bc446af37d140ce22426f651679e3b7d1c8fea83d14ef.exe

Resource

win10v2004-20220812-en

windows10-2004-x64

7 signatures

150 seconds

Behavioral task

behavioral21

Sample

9d8729b9ca0547bf3679e88b9c2c5ae941fcfe67dfd7dfc598cb304d6624ddde.exe

Resource

win7-20220901-en

evasion trojan

windows7-x64

15 signatures

150 seconds

Behavioral task

behavioral22

Sample

9d8729b9ca0547bf3679e88b9c2c5ae941fcfe67dfd7dfc598cb304d6624ddde.exe

Resource

win10v2004-20220812-en

windows10-2004-x64

12 signatures

150 seconds

Behavioral task

behavioral23

Sample

9e147a3bb22a10fe3f032dda125b871c7892065a68acd85de372e4622ec2a753.dll

Resource

win7-20221111-en

windows7-x64

1 signatures

150 seconds

Behavioral task

behavioral24

Sample

9e147a3bb22a10fe3f032dda125b871c7892065a68acd85de372e4622ec2a753.dll

Resource

win10v2004-20221111-en

windows10-2004-x64

1 signatures

150 seconds

Behavioral task

behavioral25

Sample

bccfdc8e1ac04a684732b0011d6b512118d3b6fb5a249803cd2e87427a965296.exe

Resource

win7-20221111-en

windows7-x64

3 signatures

150 seconds

Behavioral task

behavioral26

Sample

bccfdc8e1ac04a684732b0011d6b512118d3b6fb5a249803cd2e87427a965296.exe

Resource

win10v2004-20220812-en

windows10-2004-x64

5 signatures

150 seconds

Behavioral task

behavioral27

Sample

bf5a9bb619ac4bdad9a043f41b3980bf442f3965564ce612ced3cb2352311fd7.exe

Resource

win7-20220812-en

windows7-x64

0 signatures

150 seconds

Behavioral task

behavioral28

Sample

bf5a9bb619ac4bdad9a043f41b3980bf442f3965564ce612ced3cb2352311fd7.exe

Resource

win10v2004-20221111-en

windows10-2004-x64

1 signatures

150 seconds

Behavioral task

behavioral29

Sample

d0017384df7b41aba785a35c92082d1460af89204cfae22e6173eaebe16b270a.exe

Resource

win7-20220812-en

windows7-x64

1 signatures

150 seconds

Behavioral task

behavioral30

Sample

d0017384df7b41aba785a35c92082d1460af89204cfae22e6173eaebe16b270a.exe

Resource

win10v2004-20220901-en

windows10-2004-x64

1 signatures

150 seconds

Behavioral task

behavioral31

Sample

d72aa8fe30b132afe13a9be90142550b530d9687aff41954bbd3503115f37489.exe

Resource

win7-20221111-en

windows7-x64

16 signatures

150 seconds

Behavioral task

behavioral32

Sample

d72aa8fe30b132afe13a9be90142550b530d9687aff41954bbd3503115f37489.exe

Resource

win10v2004-20221111-en

windows10-2004-x64

7 signatures

150 seconds

Report Analysis Logs

General

Target

6babc5b52d59c0b41e526f06b9e751aeef7ad6fc8b9eef5f56f95d4e3cded853.dll
Size

3.4MB
MD5

4d536854aa5cbf1fc1c7d2cfc8ee65f6
SHA1

d29e0930c73e808b394c082e372033b0e57bc8b9
SHA256

6babc5b52d59c0b41e526f06b9e751aeef7ad6fc8b9eef5f56f95d4e3cded853
SHA512

1aa95fa137e5fc15b56f2155877f23e6609a440f22d143daff0436c0573ec75c528cb2a4af6d76b29085187ba2bc7ea105af65a89559445f248b466cd0079ad4
SSDEEP

49152:naJlbM2hKrp949JqBaaI8zAlhSQrhF0Cph4D4QGpUFCU/rc6jQ6qv/:Ei94AIRSQrhF0K2DX6U/rk

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1648 wrote to memory of 960	1648	rundll32.exe	27
PID 1648 wrote to memory of 960	1648	rundll32.exe	27
PID 1648 wrote to memory of 960	1648	rundll32.exe	27
PID 1648 wrote to memory of 960	1648	rundll32.exe	27
PID 1648 wrote to memory of 960	1648	rundll32.exe	27
PID 1648 wrote to memory of 960	1648	rundll32.exe	27
PID 1648 wrote to memory of 960	1648	rundll32.exe	27

Processes

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6babc5b52d59c0b41e526f06b9e751aeef7ad6fc8b9eef5f56f95d4e3cded853.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1648
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6babc5b52d59c0b41e526f06b9e751aeef7ad6fc8b9eef5f56f95d4e3cded853.dll,#1
  2⤵
  PID:960

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/960-55-0x0000000075661000-0x0000000075663000-memory.dmp

Filesize
8KB

Download