18a900e972aff001241d8e676c52c94156e3b8d68e0f82d8cd07607f1664bdf1

Resubmissions

21/08/2023, 17:42

230821-v96gzseg78 5

21/08/2023, 17:39

230821-v8b7ragd6v 5

Analysis

max time kernel
26s
max time network
20s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
21/08/2023, 17:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Mindshb.exe
Size

6.6MB
MD5

03a0f731d1fda4521dc912a2cd4f7d04
SHA1

e1e8fa96208ebe91a6259d9f51249098c4d6897e
SHA256

18a900e972aff001241d8e676c52c94156e3b8d68e0f82d8cd07607f1664bdf1
SHA512

2e29551ce0951fe2cc7c6aeb4bff7ff5233634dda12c8d4d36b13caaa7113188d2e6adb07a4d236d16ff783c40f7c7cf886bcb5542cbb43267d01c164c350abd
SSDEEP

98304:n6NB1lxxHcTX+6DxiYmpDl2yK1ERMKdY/RPl+qqKem89lh0vvi9QPyyMxoFpr:631lxx8TO6DxbmhUEh+4KefJOMU

Score

5^/10

Malware Config

Signatures

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2496	Mindshb.exe
2496	Mindshb.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2980	2496	WerFault.exe	27

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
2272	timeout.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2496	Mindshb.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 2496 wrote to memory of 2084	2496	Mindshb.exe	29
PID 2496 wrote to memory of 2084	2496	Mindshb.exe	29
PID 2496 wrote to memory of 2084	2496	Mindshb.exe	29
PID 2084 wrote to memory of 2900	2084	cmd.exe	30
PID 2084 wrote to memory of 2900	2084	cmd.exe	30
PID 2084 wrote to memory of 2900	2084	cmd.exe	30
PID 2084 wrote to memory of 2224	2084	cmd.exe	31
PID 2084 wrote to memory of 2224	2084	cmd.exe	31
PID 2084 wrote to memory of 2224	2084	cmd.exe	31
PID 2084 wrote to memory of 2356	2084	cmd.exe	32
PID 2084 wrote to memory of 2356	2084	cmd.exe	32
PID 2084 wrote to memory of 2356	2084	cmd.exe	32
PID 2496 wrote to memory of 2944	2496	Mindshb.exe	33
PID 2496 wrote to memory of 2944	2496	Mindshb.exe	33
PID 2496 wrote to memory of 2944	2496	Mindshb.exe	33
PID 2944 wrote to memory of 2288	2944	cmd.exe	34
PID 2944 wrote to memory of 2288	2944	cmd.exe	34
PID 2944 wrote to memory of 2288	2944	cmd.exe	34
PID 2496 wrote to memory of 2980	2496	Mindshb.exe	36
PID 2496 wrote to memory of 2980	2496	Mindshb.exe	36
PID 2496 wrote to memory of 2980	2496	Mindshb.exe	36
PID 2288 wrote to memory of 2272	2288	cmd.exe	37
PID 2288 wrote to memory of 2272	2288	cmd.exe	37
PID 2288 wrote to memory of 2272	2288	cmd.exe	37

C:\Users\Admin\AppData\Local\Temp\Mindshb.exe
"C:\Users\Admin\AppData\Local\Temp\Mindshb.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2496
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\Mindshb.exe" MD5 | find /i /v "md5" | find /i /v "certutil"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2084
- - C:\Windows\system32\certutil.exe
    certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\Mindshb.exe" MD5
    3⤵
    PID:2900
- - C:\Windows\system32\find.exe
    find /i /v "md5"
    3⤵
    PID:2224
- - C:\Windows\system32\find.exe
    find /i /v "certutil"
    3⤵
    PID:2356
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start cmd /C "color b && title Error && echo Signature checksum failed. Request was tampered with or session ended most likely. & echo: & echo Message: Logged in! && timeout /t 5"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2944
- - C:\Windows\system32\cmd.exe
    cmd /C "color b && title Error && echo Signature checksum failed. Request was tampered with or session ended most likely. & echo: & echo Message: Logged in! && timeout /t 5"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2288
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2272
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2496 -s 776
  2⤵
  - Program crash
  PID:2980

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2496-54-0x0000000077580000-0x0000000077582000-memory.dmp

Filesize
8KB

Download
memory/2496-56-0x000000013F030000-0x000000013FB68000-memory.dmp

Filesize
11.2MB

Download
memory/2496-57-0x0000000077580000-0x0000000077582000-memory.dmp

Filesize
8KB

Download
memory/2496-60-0x000000013F030000-0x000000013FB68000-memory.dmp

Filesize
11.2MB

Download
memory/2496-61-0x00000000775B0000-0x00000000775B2000-memory.dmp

Filesize
8KB

Download
memory/2496-63-0x00000000773D0000-0x0000000077579000-memory.dmp

Filesize
1.7MB

Download
memory/2496-59-0x0000000077580000-0x0000000077582000-memory.dmp

Filesize
8KB

Download
memory/2496-64-0x00000000775B0000-0x00000000775B2000-memory.dmp

Filesize
8KB

Download
memory/2496-66-0x00000000775B0000-0x00000000775B2000-memory.dmp

Filesize
8KB

Download
memory/2496-71-0x000000013F030000-0x000000013FB68000-memory.dmp

Filesize
11.2MB

Download
memory/2496-72-0x00000000773D0000-0x0000000077579000-memory.dmp

Filesize
1.7MB

Download
memory/2496-74-0x000000013F030000-0x000000013FB68000-memory.dmp

Filesize
11.2MB

Download
memory/2496-73-0x00000000773D0000-0x0000000077579000-memory.dmp

Filesize
1.7MB

Download