1d0128fd3184a765076397dd308e51bbc578a3639cb9c08ab6b5c36704d772b4

Resubmissions

14-11-2023 17:31

231114-v3qg7acf42 10

14-11-2023 17:21

28-10-2023 19:29

24-10-2023 13:29

18-10-2023 12:04

07-09-2023 12:10

Analysis

max time kernel
14s
max time network
18s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
07-09-2023 12:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ded033da36fbf8287d0df6f21a0339b6e1046ce678b46e7cd558f63e22df1158.exe
Size

278KB
MD5

6621340d04e507aaa1595cc078de9d74
SHA1

ea59335ea2c7504eeb1227cb741fee0d1ba1caf1
SHA256

ded033da36fbf8287d0df6f21a0339b6e1046ce678b46e7cd558f63e22df1158
SHA512

a9cb0f631e56e7350713e1c1c70fb62c2c5c40e89b2d74c3fb5e496cddef59497aae2bd8a4dbe0d8259cde7dadefd555c705b1b788f1d866b0d957966a95e6e3
SSDEEP

6144:QhNy9Dw3FKqOiUjkMbQ5DWku3s2A9/voANg6tOmEhko3laTv0vQ:8sJjkuQ5Yo9/vLyuOxkyaLl

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2624	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2776	svhest.exe

Drops file in System32 directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\ieapfltr.dat	svhest.exe
File opened for modification	C:\Windows\SysWOW64\svhest.exe	svhest.exe
File opened for modification	C:\Windows\SysWOW64\ieapfltr.dat	ded033da36fbf8287d0df6f21a0339b6e1046ce678b46e7cd558f63e22df1158.exe
File created	C:\Windows\SysWOW64\svhest.exe	ded033da36fbf8287d0df6f21a0339b6e1046ce678b46e7cd558f63e22df1158.exe
File opened for modification	C:\Windows\SysWOW64\svhest.exe	ded033da36fbf8287d0df6f21a0339b6e1046ce678b46e7cd558f63e22df1158.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\RAV2007.BAT	ded033da36fbf8287d0df6f21a0339b6e1046ce678b46e7cd558f63e22df1158.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2168 wrote to memory of 2624	2168	ded033da36fbf8287d0df6f21a0339b6e1046ce678b46e7cd558f63e22df1158.exe	30
PID 2168 wrote to memory of 2624	2168	ded033da36fbf8287d0df6f21a0339b6e1046ce678b46e7cd558f63e22df1158.exe	30
PID 2168 wrote to memory of 2624	2168	ded033da36fbf8287d0df6f21a0339b6e1046ce678b46e7cd558f63e22df1158.exe	30
PID 2168 wrote to memory of 2624	2168	ded033da36fbf8287d0df6f21a0339b6e1046ce678b46e7cd558f63e22df1158.exe	30

C:\Users\Admin\AppData\Local\Temp\ded033da36fbf8287d0df6f21a0339b6e1046ce678b46e7cd558f63e22df1158.exe
"C:\Users\Admin\AppData\Local\Temp\ded033da36fbf8287d0df6f21a0339b6e1046ce678b46e7cd558f63e22df1158.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2168
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Windows\RAV2007.BAT
  2⤵
  - Deletes itself
  PID:2624

C:\Windows\SysWOW64\svhest.exe
C:\Windows\SysWOW64\svhest.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2776

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\RAV2007.BAT

Filesize
254B

MD5
e1ece2cb5162991f88824995b1e7e5e4

SHA1
95e0fb280d7b6a4f70eeb0b9f12bb9e79a344b61

SHA256
bcd2fb9574dcfe63e5eca517a2e72cbdf3246ee6766d6f46f7e5fb38d0c86222

SHA512
896f09727b683baff1a9212ad7ca70d82f22742c86c7cb3658464eddc8477c7e57ac001a3a8ffafcabdc5f1a4a5715fcc149fad399ba58a3ff54e8bb51d9672e

Download Submit
C:\Windows\RAV2007.BAT

Filesize
254B

MD5
e1ece2cb5162991f88824995b1e7e5e4

SHA1
95e0fb280d7b6a4f70eeb0b9f12bb9e79a344b61

SHA256
bcd2fb9574dcfe63e5eca517a2e72cbdf3246ee6766d6f46f7e5fb38d0c86222

SHA512
896f09727b683baff1a9212ad7ca70d82f22742c86c7cb3658464eddc8477c7e57ac001a3a8ffafcabdc5f1a4a5715fcc149fad399ba58a3ff54e8bb51d9672e

Download Submit
C:\Windows\SysWOW64\svhest.exe

Filesize
278KB

MD5
6621340d04e507aaa1595cc078de9d74

SHA1
ea59335ea2c7504eeb1227cb741fee0d1ba1caf1

SHA256
ded033da36fbf8287d0df6f21a0339b6e1046ce678b46e7cd558f63e22df1158

SHA512
a9cb0f631e56e7350713e1c1c70fb62c2c5c40e89b2d74c3fb5e496cddef59497aae2bd8a4dbe0d8259cde7dadefd555c705b1b788f1d866b0d957966a95e6e3

Download Submit
C:\Windows\SysWOW64\svhest.exe

Filesize
278KB

MD5
6621340d04e507aaa1595cc078de9d74

SHA1
ea59335ea2c7504eeb1227cb741fee0d1ba1caf1

SHA256
ded033da36fbf8287d0df6f21a0339b6e1046ce678b46e7cd558f63e22df1158

SHA512
a9cb0f631e56e7350713e1c1c70fb62c2c5c40e89b2d74c3fb5e496cddef59497aae2bd8a4dbe0d8259cde7dadefd555c705b1b788f1d866b0d957966a95e6e3

Download Submit
memory/2168-0-0x0000000000400000-0x0000000000535000-memory.dmp

Filesize
1.2MB

Download
memory/2168-1-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2168-2-0x0000000000400000-0x0000000000535000-memory.dmp

Filesize
1.2MB

Download
memory/2168-17-0x0000000000400000-0x0000000000535000-memory.dmp

Filesize
1.2MB

Download
memory/2776-5-0x0000000000400000-0x0000000000535000-memory.dmp

Filesize
1.2MB

Download
memory/2776-7-0x00000000001B0000-0x00000000001B1000-memory.dmp

Filesize
4KB

Download
memory/2776-6-0x0000000000400000-0x0000000000535000-memory.dmp

Filesize
1.2MB

Download
memory/2776-9-0x0000000000400000-0x0000000000535000-memory.dmp

Filesize
1.2MB

Download