Analysis
-
max time kernel
148s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
04/02/2023, 17:36
Static task
static1
Behavioral task
behavioral1
Sample
BitTorrent Pro v7.11.0.46471 Portable Cracked {CracksHash} New.zip
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
BitTorrent Pro v7.11.0.46471 Portable Cracked {CracksHash} New.zip
Resource
win10v2004-20220812-en
Behavioral task
behavioral3
Sample
BitTorrent Pro v7.11.0.46471 Portable Cracked {CracksHash} New/BitTorrent Pro v7.11.0.46471 Portable.exe
Resource
win7-20221111-en
Behavioral task
behavioral4
Sample
BitTorrent Pro v7.11.0.46471 Portable Cracked {CracksHash} New/BitTorrent Pro v7.11.0.46471 Portable.exe
Resource
win10v2004-20220812-en
General
-
Target
BitTorrent Pro v7.11.0.46471 Portable Cracked {CracksHash} New/BitTorrent Pro v7.11.0.46471 Portable.exe
-
Size
30.6MB
-
MD5
9b593aff8419740c9be4cad0f70baa11
-
SHA1
d0fe175a104c0fc76523c41c88fd3c11c94b1e28
-
SHA256
aeb81c2c1383faef245667236f60bca15c9dbe6bd6564ab2d60a0c94be1ca3a5
-
SHA512
2d2b4c1f4de7fb219106de5e96385d2bbac14729c94c52ad0f045b25dc81d2a16a1d4d55cc3e6cbc3bfd39c9b7d7f798c5bbef11dfd8b6082380e3cb8f796f33
-
SSDEEP
393216:CvVONdu/Z5vVbNdu/Z5vV3Ndu/Z5vV3Ndu/ZnvV3Ndu/ZnvI3Ndu/ZsvI3Ndu/Zd:C9Qa59Za599a599an99anA9asA9auw
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2444 BitTorrent Pro v7.11.0.46471 Portable.tmp -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2704 wrote to memory of 2444 2704 BitTorrent Pro v7.11.0.46471 Portable.exe 81 PID 2704 wrote to memory of 2444 2704 BitTorrent Pro v7.11.0.46471 Portable.exe 81 PID 2704 wrote to memory of 2444 2704 BitTorrent Pro v7.11.0.46471 Portable.exe 81
Processes
-
C:\Users\Admin\AppData\Local\Temp\BitTorrent Pro v7.11.0.46471 Portable Cracked {CracksHash} New\BitTorrent Pro v7.11.0.46471 Portable.exe"C:\Users\Admin\AppData\Local\Temp\BitTorrent Pro v7.11.0.46471 Portable Cracked {CracksHash} New\BitTorrent Pro v7.11.0.46471 Portable.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2704 -
C:\Users\Admin\AppData\Local\Temp\is-SHMSJ.tmp\BitTorrent Pro v7.11.0.46471 Portable.tmp"C:\Users\Admin\AppData\Local\Temp\is-SHMSJ.tmp\BitTorrent Pro v7.11.0.46471 Portable.tmp" /SL5="$C003E,31274364,780800,C:\Users\Admin\AppData\Local\Temp\BitTorrent Pro v7.11.0.46471 Portable Cracked {CracksHash} New\BitTorrent Pro v7.11.0.46471 Portable.exe"2⤵
- Executes dropped EXE
PID:2444
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.9MB
MD54ea7488229c8a49d65f3acec47af53e2
SHA12cbd2ae2caef5a34327d20d24396d502472f672a
SHA256539fb66cf2f75556cf95f5849e35e7f038f11ac1ba7da106379a6d167f43128b
SHA51253ae988ba5746d0eb9a86a8a7439b4a464ea866fe2bd2e506a542b881cb24542a545e8046ebcc39e00db5adcdb8328320608dd43b37ad00269e775773c757f46