e7f0a03d34cf93e1dc0bc78b4d08436de180e22fada1628810873683b9b2ee73

Analysis

max time kernel
142s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
30/09/2023, 00:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SecuriteInfo.com.W32.Kryptik.KSH.gen.Eldorado.16539.23365.exe
Size 2.2MB
Sample230930-at2tmsgh75
SHA256 e7f0a03d34cf93e1dc0bc78b4d08436de180e22fada1628810873683b9b2ee73
MD5 5e403aaba5cde3f98d71d0b94c0538b1
SHA1 1c3a1f3e360d23a50dc2c2ade840cace7ef237fc
SHA512 f19439bfdfbd7e81b502048ecebae7b85ea1bb282a1c59f89dce8db0c60da684bb9a5f3bdcdbb77c168c715be859e102c6b70ac3a40caeb85fff8dff3627f12a
SSDEEP 49152:WfJPU05snBtsnHtkMJqk5DxXkFXMnaZKSMUxMdKxk0/R8T3BN:WClsHKM4oyFIWK+mlTRN
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
5044	rundll32.exe
4996	rundll32.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 3752 wrote to memory of 1816	3752	SecuriteInfo.com.W32.Kryptik.KSH.gen.Eldorado.16539.23365.exe	86
PID 3752 wrote to memory of 1816	3752	SecuriteInfo.com.W32.Kryptik.KSH.gen.Eldorado.16539.23365.exe	86
PID 3752 wrote to memory of 1816	3752	SecuriteInfo.com.W32.Kryptik.KSH.gen.Eldorado.16539.23365.exe	86
PID 1816 wrote to memory of 3504	1816	cmd.exe	88
PID 1816 wrote to memory of 3504	1816	cmd.exe	88
PID 1816 wrote to memory of 3504	1816	cmd.exe	88
PID 3504 wrote to memory of 5044	3504	control.exe	89
PID 3504 wrote to memory of 5044	3504	control.exe	89
PID 3504 wrote to memory of 5044	3504	control.exe	89
PID 5044 wrote to memory of 4452	5044	rundll32.exe	96
PID 5044 wrote to memory of 4452	5044	rundll32.exe	96
PID 4452 wrote to memory of 4996	4452	RunDll32.exe	97
PID 4452 wrote to memory of 4996	4452	RunDll32.exe	97
PID 4452 wrote to memory of 4996	4452	RunDll32.exe	97

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.Kryptik.KSH.gen.Eldorado.16539.23365.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.Kryptik.KSH.gen.Eldorado.16539.23365.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3752
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c .\N.cmD
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1816
- - C:\Windows\SysWOW64\control.exe
    coNTrOL "C:\Users\Admin\AppData\Local\Temp\7zS8AE9F047\T.2"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3504
  - - C:\Windows\SysWOW64\rundll32.exe
      "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\7zS8AE9F047\T.2"
      4⤵
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:5044
    - - C:\Windows\system32\RunDll32.exe
        
        C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\7zS8AE9F047\T.2"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4452
      - C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 "C:\Users\Admin\AppData\Local\Temp\7zS8AE9F047\T.2"
        6⤵
        Loads dropped DLL
        
        PID:4996

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

N.cmd

Path C:\Users\Admin\AppData\Local\Temp\7zS8AE9F047\N.cmd
Size 23B
SHA256 9700f7635674ec87dcae906a7765c48d146ee794033b10049ec5408e55a78501
MD5 70562dbf3feaaed94ca406abdcbd2328
SHA1 ce57401d111fa5e25dea05e49d7b23a341868910
SHA512 9708a51a160357ff475d2fa009df78d8cd2fa88c1fd8d475de6e2f5118e30d22ad204218240ec23d85a671855f8fee2250bd3ad20e1932dbeece7676a77e6c22
MD5 SHA1 SHA512

Submit Download

T.2

Path C:\Users\Admin\AppData\Local\Temp\7zS8AE9F047\T.2
Size 2.3MB
SHA256 e82c23e55fdb6647f52bcbf0a5517a828133d99e6da2d557b9f8d8353becf68e
MD5 655f5457aabb5509f9d4da5d2a30f61b
SHA1 052ee0e143599483e0c080ed9e1d9e95556adc50
SHA512 a8421ca0ce72943d71902373e26d12cb915f33a295f294bf56f2ddd01a1cf75bbcea584b35e0726b3d203087c6c0b0217f0f83e3ff161f806737714e63ea127c
SSDEEP 49152:94yf1g0WQw5jzfqLoSi4/zF9DE42luo3fhtz3N:qb7QOjTq9LFu42llz9
MD5 SHA1 SHA512 SSDEEP

Submit Download

t.2

Path C:\Users\Admin\AppData\Local\Temp\7zS8AE9F047\t.2
Size 2.3MB
SHA256 e82c23e55fdb6647f52bcbf0a5517a828133d99e6da2d557b9f8d8353becf68e
MD5 655f5457aabb5509f9d4da5d2a30f61b
SHA1 052ee0e143599483e0c080ed9e1d9e95556adc50
SHA512 a8421ca0ce72943d71902373e26d12cb915f33a295f294bf56f2ddd01a1cf75bbcea584b35e0726b3d203087c6c0b0217f0f83e3ff161f806737714e63ea127c
SSDEEP 49152:94yf1g0WQw5jzfqLoSi4/zF9DE42luo3fhtz3N:qb7QOjTq9LFu42llz9
MD5 SHA1 SHA512 SSDEEP

Submit Download

t.2

Path C:\Users\Admin\AppData\Local\Temp\7zS8AE9F047\t.2
Size 2.3MB
SHA256 e82c23e55fdb6647f52bcbf0a5517a828133d99e6da2d557b9f8d8353becf68e
MD5 655f5457aabb5509f9d4da5d2a30f61b
SHA1 052ee0e143599483e0c080ed9e1d9e95556adc50
SHA512 a8421ca0ce72943d71902373e26d12cb915f33a295f294bf56f2ddd01a1cf75bbcea584b35e0726b3d203087c6c0b0217f0f83e3ff161f806737714e63ea127c
SSDEEP 49152:94yf1g0WQw5jzfqLoSi4/zF9DE42luo3fhtz3N:qb7QOjTq9LFu42llz9
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4996-27-0x0000000003340000-0x000000000343C000-memory.dmp

Download

memory/4996-26-0x0000000003340000-0x000000000343C000-memory.dmp

Download

memory/4996-23-0x0000000003340000-0x000000000343C000-memory.dmp

Download

memory/4996-22-0x0000000003210000-0x0000000003329000-memory.dmp

Download

memory/4996-18-0x00000000029E0000-0x00000000029E6000-memory.dmp

Download

memory/5044-8-0x00000000024C0000-0x00000000024C6000-memory.dmp

Download

memory/5044-16-0x0000000002740000-0x000000000283C000-memory.dmp

Download

memory/5044-15-0x0000000002740000-0x000000000283C000-memory.dmp

Download

memory/5044-12-0x0000000002740000-0x000000000283C000-memory.dmp

Download

memory/5044-11-0x0000000002CF0000-0x0000000002E09000-memory.dmp

Download

memory/5044-9-0x0000000010000000-0x0000000010243000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads