e4b077fb97096ee373c7238484ccdf1834fae24efd0f4cd33caf75a3dff3dd09

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20230824-en
resource tags

arch:x64arch:x86image:win7-20230824-enlocale:en-usos:windows7-x64system
submitted
31/08/2023, 17:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

e4b077fb97096ee373c7238484ccdf1834fae24efd0f4cd33caf75a3dff3dd09.exe
Size

812KB
MD5

42398e25e9de92fd01389fc755600f58
SHA1

9469d24546e26744023dcf6331ef06ace15ae939
SHA256

e4b077fb97096ee373c7238484ccdf1834fae24efd0f4cd33caf75a3dff3dd09
SHA512

f5d431f3404ed27175a67f6d733879ec4ddba8660c30cd11f4c8147771e5b49491749288c2c1278ecd2293186a5601ff53e2fdaac73e7e6a575fd1b90b3fa3e0
SSDEEP

12288:pqmytVdB0rPEDb3kCoI641jxy7GHEX2rnAv8MktrOKxp22CMOZ/1Sq:pqxtVfNDb31oT41+aneOrO4p2zMOZ/V

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2288	1F0F0C0B120B156A155F15B0E0B160D0C160B.exe

Loads dropped DLL 2 IoCs

pid	Process
924	e4b077fb97096ee373c7238484ccdf1834fae24efd0f4cd33caf75a3dff3dd09.exe
924	e4b077fb97096ee373c7238484ccdf1834fae24efd0f4cd33caf75a3dff3dd09.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
924	e4b077fb97096ee373c7238484ccdf1834fae24efd0f4cd33caf75a3dff3dd09.exe
2288	1F0F0C0B120B156A155F15B0E0B160D0C160B.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 924 wrote to memory of 2288	924	e4b077fb97096ee373c7238484ccdf1834fae24efd0f4cd33caf75a3dff3dd09.exe	28
PID 924 wrote to memory of 2288	924	e4b077fb97096ee373c7238484ccdf1834fae24efd0f4cd33caf75a3dff3dd09.exe	28
PID 924 wrote to memory of 2288	924	e4b077fb97096ee373c7238484ccdf1834fae24efd0f4cd33caf75a3dff3dd09.exe	28
PID 924 wrote to memory of 2288	924	e4b077fb97096ee373c7238484ccdf1834fae24efd0f4cd33caf75a3dff3dd09.exe	28

C:\Users\Admin\AppData\Local\Temp\e4b077fb97096ee373c7238484ccdf1834fae24efd0f4cd33caf75a3dff3dd09.exe
"C:\Users\Admin\AppData\Local\Temp\e4b077fb97096ee373c7238484ccdf1834fae24efd0f4cd33caf75a3dff3dd09.exe"
1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:924
- C:\Users\Admin\AppData\Local\Temp\1F0F0C0B120B156A155F15B0E0B160D0C160B.exe
  C:\Users\Admin\AppData\Local\Temp\1F0F0C0B120B156A155F15B0E0B160D0C160B.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:2288

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\1F0F0C0B120B156A155F15B0E0B160D0C160B.exe

Filesize
812KB

MD5
3aec292dd98380556fec3efd4ca68c24

SHA1
66087d08c5b17cd349ae720b8fad41df113ea7dd

SHA256
1bad520febacf748e9a74d2f1e3035206d3a1e347ef47fcc32c156cfa8036dcb

SHA512
121cb7fa2f350e6fd480c4fa3ed57710e4bfc9c032336718278996e5610a9c4964ee28ce2f5d1a9c27b5f13065127bbef8a25d8e21baffe0cdbef2eb2dca8377

Download Submit
C:\Users\Admin\AppData\Local\Temp\1F0F0C0B120B156A155F15B0E0B160D0C160B.exe

Filesize
812KB

MD5
3aec292dd98380556fec3efd4ca68c24

SHA1
66087d08c5b17cd349ae720b8fad41df113ea7dd

SHA256
1bad520febacf748e9a74d2f1e3035206d3a1e347ef47fcc32c156cfa8036dcb

SHA512
121cb7fa2f350e6fd480c4fa3ed57710e4bfc9c032336718278996e5610a9c4964ee28ce2f5d1a9c27b5f13065127bbef8a25d8e21baffe0cdbef2eb2dca8377

Download Submit
\Users\Admin\AppData\Local\Temp\1F0F0C0B120B156A155F15B0E0B160D0C160B.exe

Filesize
812KB

MD5
3aec292dd98380556fec3efd4ca68c24

SHA1
66087d08c5b17cd349ae720b8fad41df113ea7dd

SHA256
1bad520febacf748e9a74d2f1e3035206d3a1e347ef47fcc32c156cfa8036dcb

SHA512
121cb7fa2f350e6fd480c4fa3ed57710e4bfc9c032336718278996e5610a9c4964ee28ce2f5d1a9c27b5f13065127bbef8a25d8e21baffe0cdbef2eb2dca8377

Download Submit
\Users\Admin\AppData\Local\Temp\1F0F0C0B120B156A155F15B0E0B160D0C160B.exe

Filesize
812KB

MD5
3aec292dd98380556fec3efd4ca68c24

SHA1
66087d08c5b17cd349ae720b8fad41df113ea7dd

SHA256
1bad520febacf748e9a74d2f1e3035206d3a1e347ef47fcc32c156cfa8036dcb

SHA512
121cb7fa2f350e6fd480c4fa3ed57710e4bfc9c032336718278996e5610a9c4964ee28ce2f5d1a9c27b5f13065127bbef8a25d8e21baffe0cdbef2eb2dca8377

Download Submit
memory/924-0-0x0000000000400000-0x00000000005AB000-memory.dmp

Filesize
1.7MB

Download
memory/924-1-0x0000000000400000-0x00000000005AB000-memory.dmp

Filesize
1.7MB

Download
memory/924-12-0x0000000000400000-0x00000000005AB000-memory.dmp

Filesize
1.7MB

Download
memory/924-11-0x0000000001FA0000-0x000000000214B000-memory.dmp

Filesize
1.7MB

Download
memory/2288-14-0x0000000000400000-0x00000000005AB000-memory.dmp

Filesize
1.7MB

Download
memory/2288-16-0x0000000000400000-0x00000000005AB000-memory.dmp

Filesize
1.7MB

Download
memory/2288-17-0x0000000000400000-0x00000000005AB000-memory.dmp

Filesize
1.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads