Analysis
-
max time kernel
30s -
max time network
33s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
26-02-2023 20:29
Behavioral task
behavioral1
Sample
bb2d74f0a2796cf5c4ff3f8055a89e29bdcad41e692887a7e0bb0567bdee6a99.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
bb2d74f0a2796cf5c4ff3f8055a89e29bdcad41e692887a7e0bb0567bdee6a99.exe
Resource
win10v2004-20230220-en
General
-
Target
bb2d74f0a2796cf5c4ff3f8055a89e29bdcad41e692887a7e0bb0567bdee6a99.exe
-
Size
1.9MB
-
MD5
fad4ac9878368dd2407c72e6f3c03fd4
-
SHA1
f342f78f5349b040c9ce01c0378fc23ebfe7ec30
-
SHA256
bb2d74f0a2796cf5c4ff3f8055a89e29bdcad41e692887a7e0bb0567bdee6a99
-
SHA512
caaf74abe6fef3506798d5642d3546e075f75b9aa8ea6885fce2907c1ba1a9d1755acad46e615cb59d670a98057eb69717f5d5ef2210fed2447c67e6381ddb94
-
SSDEEP
24576:ILagiQ5pjdQoJXBfBCq+hAERZbfbrRS7lQ3Uq8QDUwZjDZeWYRJZO0kGCn/CQm:ILni0QsBP++StfPQ7kU7QrD0XZOxPs
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
YShow3D.exepid process 1100 YShow3D.exe -
Loads dropped DLL 1 IoCs
Processes:
bb2d74f0a2796cf5c4ff3f8055a89e29bdcad41e692887a7e0bb0567bdee6a99.exepid process 1160 bb2d74f0a2796cf5c4ff3f8055a89e29bdcad41e692887a7e0bb0567bdee6a99.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
YShow3D.exepid process 1100 YShow3D.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
bb2d74f0a2796cf5c4ff3f8055a89e29bdcad41e692887a7e0bb0567bdee6a99.exedescription pid process target process PID 1160 wrote to memory of 1100 1160 bb2d74f0a2796cf5c4ff3f8055a89e29bdcad41e692887a7e0bb0567bdee6a99.exe YShow3D.exe PID 1160 wrote to memory of 1100 1160 bb2d74f0a2796cf5c4ff3f8055a89e29bdcad41e692887a7e0bb0567bdee6a99.exe YShow3D.exe PID 1160 wrote to memory of 1100 1160 bb2d74f0a2796cf5c4ff3f8055a89e29bdcad41e692887a7e0bb0567bdee6a99.exe YShow3D.exe PID 1160 wrote to memory of 1100 1160 bb2d74f0a2796cf5c4ff3f8055a89e29bdcad41e692887a7e0bb0567bdee6a99.exe YShow3D.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\bb2d74f0a2796cf5c4ff3f8055a89e29bdcad41e692887a7e0bb0567bdee6a99.exe"C:\Users\Admin\AppData\Local\Temp\bb2d74f0a2796cf5c4ff3f8055a89e29bdcad41e692887a7e0bb0567bdee6a99.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\YShow3D.exeC:\Users\Admin\AppData\Local\Temp\\YShow3D.exe /i Çë²åÈëÊÚȨÈí¼þËø /t Ìáʾ:B8 /k 642⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\YShow3D.exeFilesize
326KB
MD508c643c256d31bf018d9b099482ea1a7
SHA18235a6d3e6ceaf7f4237c2b81a871fa936d64984
SHA2563eb030744468aad8e778b22d62c6610f84f6c6371219e1469afed4e3f1427781
SHA512a46e5d258e145b26006dd175a41dfa9e39db92fe604683c180a1089047d9d8ef229f1761e07b66a22382f4fdf8c5e0e1e081b867228c0a63eb9f7627329d2085
-
C:\Users\Admin\AppData\Local\Temp\YShow3D.exeFilesize
326KB
MD508c643c256d31bf018d9b099482ea1a7
SHA18235a6d3e6ceaf7f4237c2b81a871fa936d64984
SHA2563eb030744468aad8e778b22d62c6610f84f6c6371219e1469afed4e3f1427781
SHA512a46e5d258e145b26006dd175a41dfa9e39db92fe604683c180a1089047d9d8ef229f1761e07b66a22382f4fdf8c5e0e1e081b867228c0a63eb9f7627329d2085
-
\Users\Admin\AppData\Local\Temp\YShow3D.exeFilesize
326KB
MD508c643c256d31bf018d9b099482ea1a7
SHA18235a6d3e6ceaf7f4237c2b81a871fa936d64984
SHA2563eb030744468aad8e778b22d62c6610f84f6c6371219e1469afed4e3f1427781
SHA512a46e5d258e145b26006dd175a41dfa9e39db92fe604683c180a1089047d9d8ef229f1761e07b66a22382f4fdf8c5e0e1e081b867228c0a63eb9f7627329d2085
-
memory/1160-54-0x0000000000400000-0x00000000006AF000-memory.dmpFilesize
2.7MB
-
memory/1160-55-0x0000000000400000-0x00000000006AF000-memory.dmpFilesize
2.7MB
-
memory/1160-62-0x0000000000400000-0x00000000006AF000-memory.dmpFilesize
2.7MB
-
memory/1160-63-0x0000000002420000-0x000000000254B000-memory.dmpFilesize
1.2MB