663c2dbb3369e9a67a3e995f714154f4c275906c96fb0af24c7437c07ed542d1

Analysis

max time kernel
123s
max time network
136s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
12-01-2023 03:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bd384eb4dd47543a0d0aaf58496df3211dcd6bd4b94a11378f07b10938ec8733.exe
Size

1.3MB
MD5

caa616e3819264a6640506d11e2698a1
SHA1

54b5c0121d76b123f36d3a1debce1c76bd76a610
SHA256

bd384eb4dd47543a0d0aaf58496df3211dcd6bd4b94a11378f07b10938ec8733
SHA512

e34c958cb2bb470e335161713d731eb8d090a4fb6e714e0cf30a09db0c68a0446c4464ec1bbee8de8ed195a45d98800c31c92734d7b5bbf289f4cf6321b3634b
SSDEEP

24576:LlsopsatOPO64ekzs3qaVG57J7JlIbcnypJUGdj33GhzkCfEdKcQh:LlsoWXPO5g6Dt5L6cnCJ7yFkU

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2036	I2B2CNFKZR0C6Z.exe

Loads dropped DLL 1 IoCs

pid	Process
2036	I2B2CNFKZR0C6Z.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2036	I2B2CNFKZR0C6Z.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 840 wrote to memory of 2036	840	bd384eb4dd47543a0d0aaf58496df3211dcd6bd4b94a11378f07b10938ec8733.exe	28
PID 840 wrote to memory of 2036	840	bd384eb4dd47543a0d0aaf58496df3211dcd6bd4b94a11378f07b10938ec8733.exe	28
PID 840 wrote to memory of 2036	840	bd384eb4dd47543a0d0aaf58496df3211dcd6bd4b94a11378f07b10938ec8733.exe	28
PID 840 wrote to memory of 2036	840	bd384eb4dd47543a0d0aaf58496df3211dcd6bd4b94a11378f07b10938ec8733.exe	28

C:\Users\Admin\AppData\Local\Temp\bd384eb4dd47543a0d0aaf58496df3211dcd6bd4b94a11378f07b10938ec8733.exe
"C:\Users\Admin\AppData\Local\Temp\bd384eb4dd47543a0d0aaf58496df3211dcd6bd4b94a11378f07b10938ec8733.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:840
- C:\Users\Admin\AppData\Roaming\OC49J\I2B2CNFKZR0C6Z.exe
  C:\Users\Admin\AppData\Roaming\OC49J\I2B2CNFKZR0C6Z.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:2036

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\OC49J\I2B2CNFKZR0C6Z.data

Filesize
252B

MD5
7ca773e631f4e528d11da2063b6e50e4

SHA1
5a5227e1e932a0f30fe2aeca80ef16d492881407

SHA256
abd313f0128abb934e019c96509e7fae1514bec3535b455779b81405871796b3

SHA512
444df45d85857e97c75b4fde895b13613594ac568092f401d846b0fe66eff82d9fa502fcda2d38e7851cf359dd1893ff78d436fef53841b1e54f3f99a988c7f1

Download Submit
C:\Users\Admin\AppData\Roaming\OC49J\I2B2CNFKZR0C6Z.exe

Filesize
678KB

MD5
9c38e5cfa356b47b1c060179f385f1e2

SHA1
f13ec2136c092dff2a095e2b3040977200ae0b97

SHA256
1fe4c08701c24b3592933c073ce170268ac2809e7f3b8e65f46b0e54b01e16cc

SHA512
c01972e1a8057ce9731165e31833d4c00d183438be9201b114b31eb56ea8a809d8408ff36802f3cb27849e8a20420619c4456dfd6ee28ab8ba426c3904ac37bb

Download Submit
C:\Users\Admin\AppData\Roaming\OC49J\I2B2CNFKZR0C6Z.exe

Filesize
678KB

MD5
9c38e5cfa356b47b1c060179f385f1e2

SHA1
f13ec2136c092dff2a095e2b3040977200ae0b97

SHA256
1fe4c08701c24b3592933c073ce170268ac2809e7f3b8e65f46b0e54b01e16cc

SHA512
c01972e1a8057ce9731165e31833d4c00d183438be9201b114b31eb56ea8a809d8408ff36802f3cb27849e8a20420619c4456dfd6ee28ab8ba426c3904ac37bb

Download Submit
C:\Users\Admin\AppData\Roaming\OC49J\libcef.dll

Filesize
448KB

MD5
d93c9553cac111bf10ea9fef66c018cb

SHA1
dffa7b8e5b4b5a8cb41fa55d3bdc485ad9f89f85

SHA256
f3c7f9276cf0406f5799d88df0b9e8db7cc33a4ea61e7e0579ca6f57610bb77a

SHA512
cc91434ceaf6ec21db0253d9db959d1f6abed7c58b2c7912d604d7c3ab07ea372c43ac4210fdf3004ac62e2e995afb636dd4fd347a5623acba38d5394de248f1

Download Submit
\Users\Admin\AppData\Roaming\OC49J\libcef.dll

Filesize
448KB

MD5
d93c9553cac111bf10ea9fef66c018cb

SHA1
dffa7b8e5b4b5a8cb41fa55d3bdc485ad9f89f85

SHA256
f3c7f9276cf0406f5799d88df0b9e8db7cc33a4ea61e7e0579ca6f57610bb77a

SHA512
cc91434ceaf6ec21db0253d9db959d1f6abed7c58b2c7912d604d7c3ab07ea372c43ac4210fdf3004ac62e2e995afb636dd4fd347a5623acba38d5394de248f1

Download Submit
memory/2036-58-0x0000000075A91000-0x0000000075A93000-memory.dmp

Filesize
8KB

Download
memory/2036-60-0x0000000000BE0000-0x0000000000CCC000-memory.dmp

Filesize
944KB

Download
memory/2036-62-0x0000000000BE0000-0x0000000000CCC000-memory.dmp

Filesize
944KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads