9ec559c858aa2cbf3ce6baff075b5accc5b44a114d355bbba80f846a045b5b45

Analysis

max time kernel
28s
max time network
32s
platform
windows7_x64
resource
win7-20230703-en
resource tags

arch:x64arch:x86image:win7-20230703-enlocale:en-usos:windows7-x64system
submitted
08/07/2023, 10:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

6f20241fb808ccexeexeexeex.exe
Size

372KB
MD5

6f20241fb808cc5155d055533aa32758
SHA1

5477f0097d622489af7992d53d21c908f7056251
SHA256

9ec559c858aa2cbf3ce6baff075b5accc5b44a114d355bbba80f846a045b5b45
SHA512

6a4338ffdcdc20c83a52fc89c12e0a8bcca07c0b8b809e14392b690a27e156ef69be381f4af05b3e79f0eb83b55a2676577d1f88ece403b9d710bbec5cabfeb1
SSDEEP

6144:SplrlbbDdQaqd2X/96fr3KFEUGjr8uB2WgcA0cpXEVNrvGZ4FUqm6:SplrVbDdQaqdS/ofraFErH8uB2Wm0SXj

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2416	Dsetup1.exe

Loads dropped DLL 4 IoCs

pid	Process
1708	6f20241fb808ccexeexeexeex.exe
2416	Dsetup1.exe
2416	Dsetup1.exe
2416	Dsetup1.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\contain\Dsetup1.exe	6f20241fb808ccexeexeexeex.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
1708	6f20241fb808ccexeexeexeex.exe
1708	6f20241fb808ccexeexeexeex.exe
1708	6f20241fb808ccexeexeexeex.exe
1708	6f20241fb808ccexeexeexeex.exe
2416	Dsetup1.exe
2416	Dsetup1.exe
2416	Dsetup1.exe
2416	Dsetup1.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1708 wrote to memory of 2416	1708	6f20241fb808ccexeexeexeex.exe	29
PID 1708 wrote to memory of 2416	1708	6f20241fb808ccexeexeexeex.exe	29
PID 1708 wrote to memory of 2416	1708	6f20241fb808ccexeexeexeex.exe	29
PID 1708 wrote to memory of 2416	1708	6f20241fb808ccexeexeexeex.exe	29
PID 1708 wrote to memory of 2416	1708	6f20241fb808ccexeexeexeex.exe	29
PID 1708 wrote to memory of 2416	1708	6f20241fb808ccexeexeexeex.exe	29
PID 1708 wrote to memory of 2416	1708	6f20241fb808ccexeexeexeex.exe	29

C:\Users\Admin\AppData\Local\Temp\6f20241fb808ccexeexeexeex.exe
"C:\Users\Admin\AppData\Local\Temp\6f20241fb808ccexeexeexeex.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1708
- C:\Program Files\contain\Dsetup1.exe
  "C:\Program Files\contain\Dsetup1.exe" "33201"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:2416

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\contain\Dsetup1.exe

Filesize
373KB

MD5
21836fe9cadd90065e4ab18756183162

SHA1
c4e1422ae39897487c3111827406145f7acdd887

SHA256
4f7cd9c46742950d3d5f657577650dfaa9bce678ba22a8d3a640f3ee07e5af59

SHA512
444117ec8fe08429d982268f393ceaf2ac0f57e22ca24f0ed98abfc1ca1407299f290cff11a49ffd2f2e5d6ca9a671bcf7f3a3cee622385a8228c42a00639c0f

Download Submit
C:\Program Files\contain\Dsetup1.exe

Filesize
373KB

MD5
21836fe9cadd90065e4ab18756183162

SHA1
c4e1422ae39897487c3111827406145f7acdd887

SHA256
4f7cd9c46742950d3d5f657577650dfaa9bce678ba22a8d3a640f3ee07e5af59

SHA512
444117ec8fe08429d982268f393ceaf2ac0f57e22ca24f0ed98abfc1ca1407299f290cff11a49ffd2f2e5d6ca9a671bcf7f3a3cee622385a8228c42a00639c0f

Download Submit
\Program Files\contain\Dsetup1.exe

Filesize
373KB

MD5
21836fe9cadd90065e4ab18756183162

SHA1
c4e1422ae39897487c3111827406145f7acdd887

SHA256
4f7cd9c46742950d3d5f657577650dfaa9bce678ba22a8d3a640f3ee07e5af59

SHA512
444117ec8fe08429d982268f393ceaf2ac0f57e22ca24f0ed98abfc1ca1407299f290cff11a49ffd2f2e5d6ca9a671bcf7f3a3cee622385a8228c42a00639c0f

Download Submit
\Program Files\contain\Dsetup1.exe

Filesize
373KB

MD5
21836fe9cadd90065e4ab18756183162

SHA1
c4e1422ae39897487c3111827406145f7acdd887

SHA256
4f7cd9c46742950d3d5f657577650dfaa9bce678ba22a8d3a640f3ee07e5af59

SHA512
444117ec8fe08429d982268f393ceaf2ac0f57e22ca24f0ed98abfc1ca1407299f290cff11a49ffd2f2e5d6ca9a671bcf7f3a3cee622385a8228c42a00639c0f

Download Submit
\Program Files\contain\Dsetup1.exe

Filesize
373KB

MD5
21836fe9cadd90065e4ab18756183162

SHA1
c4e1422ae39897487c3111827406145f7acdd887

SHA256
4f7cd9c46742950d3d5f657577650dfaa9bce678ba22a8d3a640f3ee07e5af59

SHA512
444117ec8fe08429d982268f393ceaf2ac0f57e22ca24f0ed98abfc1ca1407299f290cff11a49ffd2f2e5d6ca9a671bcf7f3a3cee622385a8228c42a00639c0f

Download Submit
\Program Files\contain\Dsetup1.exe

Filesize
373KB

MD5
21836fe9cadd90065e4ab18756183162

SHA1
c4e1422ae39897487c3111827406145f7acdd887

SHA256
4f7cd9c46742950d3d5f657577650dfaa9bce678ba22a8d3a640f3ee07e5af59

SHA512
444117ec8fe08429d982268f393ceaf2ac0f57e22ca24f0ed98abfc1ca1407299f290cff11a49ffd2f2e5d6ca9a671bcf7f3a3cee622385a8228c42a00639c0f

Download Submit