Analysis
-
max time kernel
146s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
30/08/2023, 21:34
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
da335be220dabc492e5544e46074dec566c36dc173d186d416e278bfb6330107.exe
Resource
win7-20230712-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
da335be220dabc492e5544e46074dec566c36dc173d186d416e278bfb6330107.exe
Resource
win10v2004-20230703-en
windows10-2004-x64
7 signatures
150 seconds
General
-
Target
da335be220dabc492e5544e46074dec566c36dc173d186d416e278bfb6330107.exe
-
Size
9.2MB
-
MD5
912de51e8cafeccce873cb358809f1f6
-
SHA1
18865f500e551839ccc9449d9e08ddd6d0e4a1b3
-
SHA256
da335be220dabc492e5544e46074dec566c36dc173d186d416e278bfb6330107
-
SHA512
9c21e7f21a25861bd452057a76fe807f7f99bb25f93ce66441c51ecc716c31a9d6ff549b28984333d9225fd89efcde34603587bf787fde76d50543da34a20ead
-
SSDEEP
196608:3Dbo9lGZGm4KxOcEYPk/EmEyv6YgCTlwc8Ev1:zoJe8cME12Lwc8y1
Score
7/10
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/2096-1-0x0000000002EA0000-0x0000000003084000-memory.dmp upx behavioral2/memory/2096-0-0x0000000002EA0000-0x0000000003084000-memory.dmp upx behavioral2/memory/2096-2-0x0000000002EA0000-0x0000000003084000-memory.dmp upx behavioral2/memory/2096-5-0x0000000002EA0000-0x0000000003084000-memory.dmp upx behavioral2/memory/2096-6-0x0000000002EA0000-0x0000000003084000-memory.dmp upx behavioral2/memory/2096-7-0x0000000002EA0000-0x0000000003084000-memory.dmp upx behavioral2/memory/2096-15-0x0000000002EA0000-0x0000000003084000-memory.dmp upx behavioral2/memory/2096-20-0x0000000002EA0000-0x0000000003084000-memory.dmp upx behavioral2/memory/2096-23-0x0000000002EA0000-0x0000000003084000-memory.dmp upx -
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\port.dll da335be220dabc492e5544e46074dec566c36dc173d186d416e278bfb6330107.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\·þÎñÆ÷2.txt da335be220dabc492e5544e46074dec566c36dc173d186d416e278bfb6330107.exe File created C:\Windows\SKB\newserver.txt da335be220dabc492e5544e46074dec566c36dc173d186d416e278bfb6330107.exe -
Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
pid Process 3692 systeminfo.exe -
Suspicious behavior: EnumeratesProcesses 58 IoCs
pid Process 2096 da335be220dabc492e5544e46074dec566c36dc173d186d416e278bfb6330107.exe 2096 da335be220dabc492e5544e46074dec566c36dc173d186d416e278bfb6330107.exe 2096 da335be220dabc492e5544e46074dec566c36dc173d186d416e278bfb6330107.exe 2096 da335be220dabc492e5544e46074dec566c36dc173d186d416e278bfb6330107.exe 2096 da335be220dabc492e5544e46074dec566c36dc173d186d416e278bfb6330107.exe 2096 da335be220dabc492e5544e46074dec566c36dc173d186d416e278bfb6330107.exe 2096 da335be220dabc492e5544e46074dec566c36dc173d186d416e278bfb6330107.exe 2096 da335be220dabc492e5544e46074dec566c36dc173d186d416e278bfb6330107.exe 2096 da335be220dabc492e5544e46074dec566c36dc173d186d416e278bfb6330107.exe 2096 da335be220dabc492e5544e46074dec566c36dc173d186d416e278bfb6330107.exe 2096 da335be220dabc492e5544e46074dec566c36dc173d186d416e278bfb6330107.exe 2096 da335be220dabc492e5544e46074dec566c36dc173d186d416e278bfb6330107.exe 2096 da335be220dabc492e5544e46074dec566c36dc173d186d416e278bfb6330107.exe 2096 da335be220dabc492e5544e46074dec566c36dc173d186d416e278bfb6330107.exe 2096 da335be220dabc492e5544e46074dec566c36dc173d186d416e278bfb6330107.exe 2096 da335be220dabc492e5544e46074dec566c36dc173d186d416e278bfb6330107.exe 2096 da335be220dabc492e5544e46074dec566c36dc173d186d416e278bfb6330107.exe 2096 da335be220dabc492e5544e46074dec566c36dc173d186d416e278bfb6330107.exe 2096 da335be220dabc492e5544e46074dec566c36dc173d186d416e278bfb6330107.exe 2096 da335be220dabc492e5544e46074dec566c36dc173d186d416e278bfb6330107.exe 2096 da335be220dabc492e5544e46074dec566c36dc173d186d416e278bfb6330107.exe 2096 da335be220dabc492e5544e46074dec566c36dc173d186d416e278bfb6330107.exe 2096 da335be220dabc492e5544e46074dec566c36dc173d186d416e278bfb6330107.exe 2096 da335be220dabc492e5544e46074dec566c36dc173d186d416e278bfb6330107.exe 2096 da335be220dabc492e5544e46074dec566c36dc173d186d416e278bfb6330107.exe 2096 da335be220dabc492e5544e46074dec566c36dc173d186d416e278bfb6330107.exe 2096 da335be220dabc492e5544e46074dec566c36dc173d186d416e278bfb6330107.exe 2096 da335be220dabc492e5544e46074dec566c36dc173d186d416e278bfb6330107.exe 2096 da335be220dabc492e5544e46074dec566c36dc173d186d416e278bfb6330107.exe 2096 da335be220dabc492e5544e46074dec566c36dc173d186d416e278bfb6330107.exe 2096 da335be220dabc492e5544e46074dec566c36dc173d186d416e278bfb6330107.exe 2096 da335be220dabc492e5544e46074dec566c36dc173d186d416e278bfb6330107.exe 2096 da335be220dabc492e5544e46074dec566c36dc173d186d416e278bfb6330107.exe 2096 da335be220dabc492e5544e46074dec566c36dc173d186d416e278bfb6330107.exe 2096 da335be220dabc492e5544e46074dec566c36dc173d186d416e278bfb6330107.exe 2096 da335be220dabc492e5544e46074dec566c36dc173d186d416e278bfb6330107.exe 2096 da335be220dabc492e5544e46074dec566c36dc173d186d416e278bfb6330107.exe 2096 da335be220dabc492e5544e46074dec566c36dc173d186d416e278bfb6330107.exe 2096 da335be220dabc492e5544e46074dec566c36dc173d186d416e278bfb6330107.exe 2096 da335be220dabc492e5544e46074dec566c36dc173d186d416e278bfb6330107.exe 2096 da335be220dabc492e5544e46074dec566c36dc173d186d416e278bfb6330107.exe 2096 da335be220dabc492e5544e46074dec566c36dc173d186d416e278bfb6330107.exe 2096 da335be220dabc492e5544e46074dec566c36dc173d186d416e278bfb6330107.exe 2096 da335be220dabc492e5544e46074dec566c36dc173d186d416e278bfb6330107.exe 2096 da335be220dabc492e5544e46074dec566c36dc173d186d416e278bfb6330107.exe 2096 da335be220dabc492e5544e46074dec566c36dc173d186d416e278bfb6330107.exe 2096 da335be220dabc492e5544e46074dec566c36dc173d186d416e278bfb6330107.exe 2096 da335be220dabc492e5544e46074dec566c36dc173d186d416e278bfb6330107.exe 2096 da335be220dabc492e5544e46074dec566c36dc173d186d416e278bfb6330107.exe 2096 da335be220dabc492e5544e46074dec566c36dc173d186d416e278bfb6330107.exe 2096 da335be220dabc492e5544e46074dec566c36dc173d186d416e278bfb6330107.exe 2096 da335be220dabc492e5544e46074dec566c36dc173d186d416e278bfb6330107.exe 2096 da335be220dabc492e5544e46074dec566c36dc173d186d416e278bfb6330107.exe 2096 da335be220dabc492e5544e46074dec566c36dc173d186d416e278bfb6330107.exe 2096 da335be220dabc492e5544e46074dec566c36dc173d186d416e278bfb6330107.exe 2096 da335be220dabc492e5544e46074dec566c36dc173d186d416e278bfb6330107.exe 2096 da335be220dabc492e5544e46074dec566c36dc173d186d416e278bfb6330107.exe 2096 da335be220dabc492e5544e46074dec566c36dc173d186d416e278bfb6330107.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2096 da335be220dabc492e5544e46074dec566c36dc173d186d416e278bfb6330107.exe 2096 da335be220dabc492e5544e46074dec566c36dc173d186d416e278bfb6330107.exe 2096 da335be220dabc492e5544e46074dec566c36dc173d186d416e278bfb6330107.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2096 wrote to memory of 4644 2096 da335be220dabc492e5544e46074dec566c36dc173d186d416e278bfb6330107.exe 83 PID 2096 wrote to memory of 4644 2096 da335be220dabc492e5544e46074dec566c36dc173d186d416e278bfb6330107.exe 83 PID 2096 wrote to memory of 4644 2096 da335be220dabc492e5544e46074dec566c36dc173d186d416e278bfb6330107.exe 83 PID 4644 wrote to memory of 3692 4644 cmd.exe 85 PID 4644 wrote to memory of 3692 4644 cmd.exe 85 PID 4644 wrote to memory of 3692 4644 cmd.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\da335be220dabc492e5544e46074dec566c36dc173d186d416e278bfb6330107.exe"C:\Users\Admin\AppData\Local\Temp\da335be220dabc492e5544e46074dec566c36dc173d186d416e278bfb6330107.exe"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2096 -
C:\Windows\SysWOW64\cmd.execmd.exe /c systeminfo2⤵
- Suspicious use of WriteProcessMemory
PID:4644 -
C:\Windows\SysWOW64\systeminfo.exesysteminfo3⤵
- Gathers system information
PID:3692
-
-