e65f867d40587a1449fdfa6a57c9532cfd735d593a7d7db762bddbc91645ffe5

Analysis

max time kernel
2s
max time network
15s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
12/06/2023, 14:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
01598099.exe
Size 79KB
Sample230612-rd9b8ada31
SHA256 e65f867d40587a1449fdfa6a57c9532cfd735d593a7d7db762bddbc91645ffe5
MD5 a5dbe381d916be461b7e103069d184b3
SHA1 05948069fecd91e80ef08958ff2d8bcc983db360
SHA512 20576b91c035abe8d5ed6bf93d5c5a5cbb21c4520f9f1350dca36ae04103808ee30fd8158199c8a8e48d75d7ecc61210e00336912fc61ca2f9a3cbdd1271ad82
SSDEEP 1536:sBQ4SfH9mBPxszVJk2e7J2wHL10JrmKP0fq:s+48H9mZxszVy2e7JjHL0qM0fq
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
868	winver.exe
868	winver.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
868	winver.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 4292 wrote to memory of 868	4292	01598099.exe	83
PID 4292 wrote to memory of 868	4292	01598099.exe	83
PID 4292 wrote to memory of 868	4292	01598099.exe	83
PID 4292 wrote to memory of 868	4292	01598099.exe	83
PID 868 wrote to memory of 3160	868	winver.exe	57
PID 868 wrote to memory of 2436	868	winver.exe	43
PID 868 wrote to memory of 2444	868	winver.exe	44
PID 868 wrote to memory of 2592	868	winver.exe	48
PID 868 wrote to memory of 3160	868	winver.exe	57
PID 868 wrote to memory of 3264	868	winver.exe	56
PID 868 wrote to memory of 3512	868	winver.exe	55

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2436

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2444

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:2592

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3512

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3264

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3160
- C:\Users\Admin\AppData\Local\Temp\01598099.exe
  "C:\Users\Admin\AppData\Local\Temp\01598099.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4292
- - C:\Windows\SysWOW64\winver.exe
    winver
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:868

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/868-140-0x0000000000C90000-0x0000000000C97000-memory.dmp

Download

memory/868-134-0x0000000000C90000-0x0000000000C97000-memory.dmp

Download

memory/868-136-0x0000000000C90000-0x0000000000C97000-memory.dmp

Download

memory/2436-143-0x00000000008D0000-0x00000000008D7000-memory.dmp

Download

memory/2444-144-0x0000000000F40000-0x0000000000F47000-memory.dmp

Download

memory/2592-145-0x00000000009F0000-0x00000000009F7000-memory.dmp

Download

memory/3160-135-0x0000000000DA0000-0x0000000000DA7000-memory.dmp

Download

memory/3160-133-0x0000000000DA0000-0x0000000000DA7000-memory.dmp

Download

memory/3160-146-0x0000000000DB0000-0x0000000000DB7000-memory.dmp

Download

memory/3264-147-0x0000000000C40000-0x0000000000C47000-memory.dmp

Download

memory/3512-148-0x0000000000790000-0x0000000000797000-memory.dmp

Download

memory/4292-137-0x0000000002160000-0x0000000002166000-memory.dmp

Download

memory/4292-139-0x0000000002280000-0x0000000002C80000-memory.dmp

Download

memory/4292-138-0x0000000000400000-0x0000000000405000-memory.dmp

Download