Overview

overview

10

Static

static

3

xiWD7pKGwRtj8hd.exe

windows7-x64

7

xiWD7pKGwRtj8hd.exe

windows10-2004-x64

10

Resubmissions

27-04-2023 22:29

230427-2egzgacc61 10

27-04-2023 22:27

230427-2dbq3aac79 10

27-04-2023 22:19

230427-18ycwaac67 10

27-04-2023 22:17

230427-17r5gaac63 10

27-04-2023 22:09

230427-123zsacb9w 10

27-04-2023 21:53

230427-1rzvdaab83 10

27-04-2023 21:45

230427-1mblzscb3s 10

27-04-2023 21:35

230427-1fg57aca8w 10

27-04-2023 21:23

230427-z8tt1saa65 10

Analysis

  • max time kernel
    1608s
  • max time network
    1612s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    23-03-2023 05:56

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    xiWD7pKGwRtj8hd.exe

  • Size

    6.9MB

  • MD5

    925b225bdfaec5df3055dfc87431c593

  • SHA1

    dc38d7815845e2a63f51f57381899cf7a74f9ea0

  • SHA256

    7e47da0e1a15eebd308ddd58d2902104186c817773d7fa5e5ebd7ff282adf489

  • SHA512

    2aa927028c9d6d7e03d4cefda3c2bf5277fa2373741407fabf561e40e37b1ecc7aba6278b1b6e26d060a50a52217acee6c332460353eda3168ad72755cae0c95

  • SSDEEP

    196608:bI2HdQmRrdA6lXCy1ArqkVpKCX+PrF4Z22eghOJg9:c2HdQOlXrAZYCuPJO22egoJg

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 7 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\xiWD7pKGwRtj8hd.exe
    "C:\Users\Admin\AppData\Local\Temp\xiWD7pKGwRtj8hd.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:936
    • C:\Users\Admin\AppData\Local\Temp\xiWD7pKGwRtj8hd.exe
      "C:\Users\Admin\AppData\Local\Temp\xiWD7pKGwRtj8hd.exe"
      2⤵
      • Loads dropped DLL
      PID:1784

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\_MEI9362\api-ms-win-core-file-l1-2-0.dll
    Filesize

    20KB

    MD5

    d92e6a007fc22a1e218552ebfb65da93

    SHA1

    3c9909332e94f7b7386664a90f52730f4027a75a

    SHA256

    03bd3217eae0ef68521b39556e7491292db540f615da873dd8da538693b81862

    SHA512

    b8b0e6052e68c08e558e72c168e4ff318b1907c4dc5fc1cd1104f5cae7cc418293013dabbb30c835a5c35a456e1cb22cc352b7ae40f82b9b7311bb7419d854c7

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI9362\api-ms-win-core-file-l2-1-0.dll
    Filesize

    20KB

    MD5

    50abf0a7ee67f00f247bada185a7661c

    SHA1

    0cddac9ac4db3bf10a11d4b79085ef9cb3fb84a1

    SHA256

    f957a4c261506484b53534a9be8931c02ec1a349b3f431a858f8215cecfec3f7

    SHA512

    c2694bb5d103baff1264926a04d2f0fe156b8815a23c3748412a81cc307b71a9236a0e974b5549321014065e393d10228a0f0004df9ba677f03b5d244a64b528

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI9362\api-ms-win-core-localization-l1-2-0.dll
    Filesize

    20KB

    MD5

    de5695f26a0bcb54f59a8bc3f9a4ecef

    SHA1

    99c32595f3edc2c58bdb138c3384194831e901d6

    SHA256

    e9539fce90ad8be582b25ab2d5645772c2a5fb195e602ecdbf12b980656e436a

    SHA512

    df635d5d51cdea24885ae9f0406f317ddcf04ecb6bfa26579bb2e256c457057607844ded4b52ff1f5ca25abe29d1eb2b20f1709cf19035d3829f36bbe31f550f

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI9362\api-ms-win-core-processthreads-l1-1-1.dll
    Filesize

    20KB

    MD5

    74c264cffc09d183fcb1555b16ea7e4b

    SHA1

    0b5b08cdf6e749b48254ac811ca09ba95473d47c

    SHA256

    a8e2fc077d9a7d2faa85e1e6833047c90b22c6086487b98fc0e6a86b7bf8bf09

    SHA512

    285afbcc39717510ced2ed096d9f77fc438268ecaa59cff3cf167fcc538e90c73c67652046b0ee379e0507d6e346af79d43c51a571c6dd66034f9385a73d00d1

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI9362\api-ms-win-core-timezone-l1-1-0.dll
    Filesize

    20KB

    MD5

    cb39eea2ef9ed3674c597d5f0667b5b4

    SHA1

    c133dc6416b3346fa5b0f449d7cc6f7dbf580432

    SHA256

    1627b921934053f1f7d2a19948aee06fac5db8ee8d4182e6f071718d0681f235

    SHA512

    2c65014dc045a2c1e5f52f3fea4967d2169e4a78d41fe56617ce9a4d5b30ebf25043112917ff3d7d152744ddef70475937ae0a7f96785f97dcefafe8e6f14d9c

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI9362\python310.dll
    Filesize

    4.3MB

    MD5

    54f8267c6c116d7240f8e8cd3b241cd9

    SHA1

    907b965b6ce502dad59cde70e486eb28c5517b42

    SHA256

    c30589187be320bc8e65177aeb8dc1d39957f7b7dcda4c13524dd7f436fb0948

    SHA512

    f6c865c8276fe1a1a0f3267b89fb6745a3fc82972032280dce8869006feb2b168516e017241a0c82bdae0f321fab388523691769f09a502fc3bd530c1c4cacf1

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI9362\ucrtbase.dll
    Filesize

    1.1MB

    MD5

    3b337c2d41069b0a1e43e30f891c3813

    SHA1

    ebee2827b5cb153cbbb51c9718da1549fa80fc5c

    SHA256

    c04daeba7e7c4b711d33993ab4c51a2e087f98f4211aea0dcb3a216656ba0ab7

    SHA512

    fdb3012a71221447b35757ed2bdca6ed1f8833b2f81d03aabebd2cd7780a33a9c3d816535d03c5c3edd5aaf11d91156842b380e2a63135e3c7f87193ad211499

    Download Submit

  • \Users\Admin\AppData\Local\Temp\_MEI9362\api-ms-win-core-file-l1-2-0.dll
    Filesize

    20KB

    MD5

    d92e6a007fc22a1e218552ebfb65da93

    SHA1

    3c9909332e94f7b7386664a90f52730f4027a75a

    SHA256

    03bd3217eae0ef68521b39556e7491292db540f615da873dd8da538693b81862

    SHA512

    b8b0e6052e68c08e558e72c168e4ff318b1907c4dc5fc1cd1104f5cae7cc418293013dabbb30c835a5c35a456e1cb22cc352b7ae40f82b9b7311bb7419d854c7

    Download Submit

  • \Users\Admin\AppData\Local\Temp\_MEI9362\api-ms-win-core-file-l2-1-0.dll
    Filesize

    20KB

    MD5

    50abf0a7ee67f00f247bada185a7661c

    SHA1

    0cddac9ac4db3bf10a11d4b79085ef9cb3fb84a1

    SHA256

    f957a4c261506484b53534a9be8931c02ec1a349b3f431a858f8215cecfec3f7

    SHA512

    c2694bb5d103baff1264926a04d2f0fe156b8815a23c3748412a81cc307b71a9236a0e974b5549321014065e393d10228a0f0004df9ba677f03b5d244a64b528

    Download Submit

  • \Users\Admin\AppData\Local\Temp\_MEI9362\api-ms-win-core-localization-l1-2-0.dll
    Filesize

    20KB

    MD5

    de5695f26a0bcb54f59a8bc3f9a4ecef

    SHA1

    99c32595f3edc2c58bdb138c3384194831e901d6

    SHA256

    e9539fce90ad8be582b25ab2d5645772c2a5fb195e602ecdbf12b980656e436a

    SHA512

    df635d5d51cdea24885ae9f0406f317ddcf04ecb6bfa26579bb2e256c457057607844ded4b52ff1f5ca25abe29d1eb2b20f1709cf19035d3829f36bbe31f550f

    Download Submit

  • \Users\Admin\AppData\Local\Temp\_MEI9362\api-ms-win-core-processthreads-l1-1-1.dll
    Filesize

    20KB

    MD5

    74c264cffc09d183fcb1555b16ea7e4b

    SHA1

    0b5b08cdf6e749b48254ac811ca09ba95473d47c

    SHA256

    a8e2fc077d9a7d2faa85e1e6833047c90b22c6086487b98fc0e6a86b7bf8bf09

    SHA512

    285afbcc39717510ced2ed096d9f77fc438268ecaa59cff3cf167fcc538e90c73c67652046b0ee379e0507d6e346af79d43c51a571c6dd66034f9385a73d00d1

    Download Submit

  • \Users\Admin\AppData\Local\Temp\_MEI9362\api-ms-win-core-timezone-l1-1-0.dll
    Filesize

    20KB

    MD5

    cb39eea2ef9ed3674c597d5f0667b5b4

    SHA1

    c133dc6416b3346fa5b0f449d7cc6f7dbf580432

    SHA256

    1627b921934053f1f7d2a19948aee06fac5db8ee8d4182e6f071718d0681f235

    SHA512

    2c65014dc045a2c1e5f52f3fea4967d2169e4a78d41fe56617ce9a4d5b30ebf25043112917ff3d7d152744ddef70475937ae0a7f96785f97dcefafe8e6f14d9c

    Download Submit

  • \Users\Admin\AppData\Local\Temp\_MEI9362\python310.dll
    Filesize

    4.3MB

    MD5

    54f8267c6c116d7240f8e8cd3b241cd9

    SHA1

    907b965b6ce502dad59cde70e486eb28c5517b42

    SHA256

    c30589187be320bc8e65177aeb8dc1d39957f7b7dcda4c13524dd7f436fb0948

    SHA512

    f6c865c8276fe1a1a0f3267b89fb6745a3fc82972032280dce8869006feb2b168516e017241a0c82bdae0f321fab388523691769f09a502fc3bd530c1c4cacf1

    Download Submit

  • \Users\Admin\AppData\Local\Temp\_MEI9362\ucrtbase.dll
    Filesize

    1.1MB

    MD5

    3b337c2d41069b0a1e43e30f891c3813

    SHA1

    ebee2827b5cb153cbbb51c9718da1549fa80fc5c

    SHA256

    c04daeba7e7c4b711d33993ab4c51a2e087f98f4211aea0dcb3a216656ba0ab7

    SHA512

    fdb3012a71221447b35757ed2bdca6ed1f8833b2f81d03aabebd2cd7780a33a9c3d816535d03c5c3edd5aaf11d91156842b380e2a63135e3c7f87193ad211499

    Download Submit