da9556ef3fd609709cc07f635978b1d428cd8bd681ebbe1679b5f7c10fa0270e

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
30/09/2023, 04:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SecuriteInfo.com.Win32.Evo-gen.4881.25839.exe
Size 2.2MB
Sample230930-e4tcgaab78
SHA256 da9556ef3fd609709cc07f635978b1d428cd8bd681ebbe1679b5f7c10fa0270e
MD5 e4c9538ee2e50662bf7c2b701b8d1e57
SHA1 0be1f4fb075866dac9138b1aa3ab2e1586915528
SHA512 2790eb7cd8f5c0b5fe881322fc0a1775b631f26d2bd4444a1c875c3a49fbe1500b0419ba73e098867f333f93cc646e749d3018585cd475f423dc8b3810339955
SSDEEP 49152:ufaq87bBVQ+dZWakWcQIDI5eYB7HiP9kqvpQ1FRjro:ZpzZTZDCPGiQ1no
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 8 IoCs

pid	Process
1064	rundll32.exe
1064	rundll32.exe
1064	rundll32.exe
1064	rundll32.exe
2988	rundll32.exe
2988	rundll32.exe
2988	rundll32.exe
2988	rundll32.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 1408 wrote to memory of 2216	1408	SecuriteInfo.com.Win32.Evo-gen.4881.25839.exe	28
PID 1408 wrote to memory of 2216	1408	SecuriteInfo.com.Win32.Evo-gen.4881.25839.exe	28
PID 1408 wrote to memory of 2216	1408	SecuriteInfo.com.Win32.Evo-gen.4881.25839.exe	28
PID 1408 wrote to memory of 2216	1408	SecuriteInfo.com.Win32.Evo-gen.4881.25839.exe	28
PID 2216 wrote to memory of 2328	2216	cmd.exe	30
PID 2216 wrote to memory of 2328	2216	cmd.exe	30
PID 2216 wrote to memory of 2328	2216	cmd.exe	30
PID 2216 wrote to memory of 2328	2216	cmd.exe	30
PID 2328 wrote to memory of 1064	2328	control.exe	31
PID 2328 wrote to memory of 1064	2328	control.exe	31
PID 2328 wrote to memory of 1064	2328	control.exe	31
PID 2328 wrote to memory of 1064	2328	control.exe	31
PID 2328 wrote to memory of 1064	2328	control.exe	31
PID 2328 wrote to memory of 1064	2328	control.exe	31
PID 2328 wrote to memory of 1064	2328	control.exe	31
PID 1064 wrote to memory of 2332	1064	rundll32.exe	32
PID 1064 wrote to memory of 2332	1064	rundll32.exe	32
PID 1064 wrote to memory of 2332	1064	rundll32.exe	32
PID 1064 wrote to memory of 2332	1064	rundll32.exe	32
PID 2332 wrote to memory of 2988	2332	RunDll32.exe	33
PID 2332 wrote to memory of 2988	2332	RunDll32.exe	33
PID 2332 wrote to memory of 2988	2332	RunDll32.exe	33
PID 2332 wrote to memory of 2988	2332	RunDll32.exe	33
PID 2332 wrote to memory of 2988	2332	RunDll32.exe	33
PID 2332 wrote to memory of 2988	2332	RunDll32.exe	33
PID 2332 wrote to memory of 2988	2332	RunDll32.exe	33

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.Evo-gen.4881.25839.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.Evo-gen.4881.25839.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1408
- C:\Windows\SysWOW64\cmd.exe
  cmd /c .\6MXMQ.BAT
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2216
- - C:\Windows\SysWOW64\control.exe
    CONtRol "C:\Users\Admin\AppData\Local\Temp\7zS085A0F86\B.Tv1"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2328
  - - C:\Windows\SysWOW64\rundll32.exe
      "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\7zS085A0F86\B.Tv1"
      4⤵
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:1064
    - - C:\Windows\system32\RunDll32.exe
        
        C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\7zS085A0F86\B.Tv1"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2332
      - C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 "C:\Users\Admin\AppData\Local\Temp\7zS085A0F86\B.Tv1"
        6⤵
        Loads dropped DLL
        
        PID:2988

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

6MXmQ.bat

Path C:\Users\Admin\AppData\Local\Temp\7zS085A0F86\6MXmQ.bat
Size 23B
SHA256 8acad9bfb6e60f33a4838402984c1e7fcf7391287c035d72d6a8130c4284f31b
MD5 a2dc6739541f40e7a865ceccc736bfa9
SHA1 ed3e534852b6cd952139a8040d2f6dca6c84fdc9
SHA512 65ffbe7a60aee7679f69d8ba465505220345675021967f83d61d669bc3ae9f6aa0a96e1098e815a5dce01b82492f780f215e834197cace204a51c7d73cadb8d7
MD5 SHA1 SHA512

Submit Download

6MXmQ.bat

Path C:\Users\Admin\AppData\Local\Temp\7zS085A0F86\6MXmQ.bat
Size 23B
SHA256 8acad9bfb6e60f33a4838402984c1e7fcf7391287c035d72d6a8130c4284f31b
MD5 a2dc6739541f40e7a865ceccc736bfa9
SHA1 ed3e534852b6cd952139a8040d2f6dca6c84fdc9
SHA512 65ffbe7a60aee7679f69d8ba465505220345675021967f83d61d669bc3ae9f6aa0a96e1098e815a5dce01b82492f780f215e834197cace204a51c7d73cadb8d7
MD5 SHA1 SHA512

Submit Download

B.Tv1

Path C:\Users\Admin\AppData\Local\Temp\7zS085A0F86\B.Tv1
Size 2.3MB
SHA256 b5586a729e338c5ab432142a012e93386f3dab0d3e5587203926253be5ac76d4
MD5 cb6a3da7d75d249705b2ccba171c6c5b
SHA1 13e7771ac0f4103072f5a6aac43adcdba52bc86b
SHA512 68d4ddfb654418d1489903b4810d45376a58d2b857bf4d4d01e06a2f1b2ad879484ec68376c696e369d80c234afb3500e24c726e9ccaf760406e105327431105
SSDEEP 49152:EYUogIZSoCb0jVlHh7khGpwMGo2AfiJxB+lybUei:vXgIZvxHL+xjAfiJKli
MD5 SHA1 SHA512 SSDEEP

Submit Download

B.Tv1

Path \Users\Admin\AppData\Local\Temp\7zS085A0F86\B.Tv1
Size 2.3MB
SHA256 b5586a729e338c5ab432142a012e93386f3dab0d3e5587203926253be5ac76d4
MD5 cb6a3da7d75d249705b2ccba171c6c5b
SHA1 13e7771ac0f4103072f5a6aac43adcdba52bc86b
SHA512 68d4ddfb654418d1489903b4810d45376a58d2b857bf4d4d01e06a2f1b2ad879484ec68376c696e369d80c234afb3500e24c726e9ccaf760406e105327431105
SSDEEP 49152:EYUogIZSoCb0jVlHh7khGpwMGo2AfiJxB+lybUei:vXgIZvxHL+xjAfiJKli
MD5 SHA1 SHA512 SSDEEP

Submit Download

B.Tv1

Path \Users\Admin\AppData\Local\Temp\7zS085A0F86\B.Tv1
Size 2.3MB
SHA256 b5586a729e338c5ab432142a012e93386f3dab0d3e5587203926253be5ac76d4
MD5 cb6a3da7d75d249705b2ccba171c6c5b
SHA1 13e7771ac0f4103072f5a6aac43adcdba52bc86b
SHA512 68d4ddfb654418d1489903b4810d45376a58d2b857bf4d4d01e06a2f1b2ad879484ec68376c696e369d80c234afb3500e24c726e9ccaf760406e105327431105
SSDEEP 49152:EYUogIZSoCb0jVlHh7khGpwMGo2AfiJxB+lybUei:vXgIZvxHL+xjAfiJKli
MD5 SHA1 SHA512 SSDEEP

Submit Download

B.Tv1

Path \Users\Admin\AppData\Local\Temp\7zS085A0F86\B.Tv1
Size 2.3MB
SHA256 b5586a729e338c5ab432142a012e93386f3dab0d3e5587203926253be5ac76d4
MD5 cb6a3da7d75d249705b2ccba171c6c5b
SHA1 13e7771ac0f4103072f5a6aac43adcdba52bc86b
SHA512 68d4ddfb654418d1489903b4810d45376a58d2b857bf4d4d01e06a2f1b2ad879484ec68376c696e369d80c234afb3500e24c726e9ccaf760406e105327431105
SSDEEP 49152:EYUogIZSoCb0jVlHh7khGpwMGo2AfiJxB+lybUei:vXgIZvxHL+xjAfiJKli
MD5 SHA1 SHA512 SSDEEP

Submit Download

B.Tv1

Path \Users\Admin\AppData\Local\Temp\7zS085A0F86\B.Tv1
Size 2.3MB
SHA256 b5586a729e338c5ab432142a012e93386f3dab0d3e5587203926253be5ac76d4
MD5 cb6a3da7d75d249705b2ccba171c6c5b
SHA1 13e7771ac0f4103072f5a6aac43adcdba52bc86b
SHA512 68d4ddfb654418d1489903b4810d45376a58d2b857bf4d4d01e06a2f1b2ad879484ec68376c696e369d80c234afb3500e24c726e9ccaf760406e105327431105
SSDEEP 49152:EYUogIZSoCb0jVlHh7khGpwMGo2AfiJxB+lybUei:vXgIZvxHL+xjAfiJKli
MD5 SHA1 SHA512 SSDEEP

Submit Download

B.Tv1

Path \Users\Admin\AppData\Local\Temp\7zS085A0F86\B.Tv1
Size 2.3MB
SHA256 b5586a729e338c5ab432142a012e93386f3dab0d3e5587203926253be5ac76d4
MD5 cb6a3da7d75d249705b2ccba171c6c5b
SHA1 13e7771ac0f4103072f5a6aac43adcdba52bc86b
SHA512 68d4ddfb654418d1489903b4810d45376a58d2b857bf4d4d01e06a2f1b2ad879484ec68376c696e369d80c234afb3500e24c726e9ccaf760406e105327431105
SSDEEP 49152:EYUogIZSoCb0jVlHh7khGpwMGo2AfiJxB+lybUei:vXgIZvxHL+xjAfiJKli
MD5 SHA1 SHA512 SSDEEP

Submit Download

B.Tv1

Path \Users\Admin\AppData\Local\Temp\7zS085A0F86\B.Tv1
Size 2.3MB
SHA256 b5586a729e338c5ab432142a012e93386f3dab0d3e5587203926253be5ac76d4
MD5 cb6a3da7d75d249705b2ccba171c6c5b
SHA1 13e7771ac0f4103072f5a6aac43adcdba52bc86b
SHA512 68d4ddfb654418d1489903b4810d45376a58d2b857bf4d4d01e06a2f1b2ad879484ec68376c696e369d80c234afb3500e24c726e9ccaf760406e105327431105
SSDEEP 49152:EYUogIZSoCb0jVlHh7khGpwMGo2AfiJxB+lybUei:vXgIZvxHL+xjAfiJKli
MD5 SHA1 SHA512 SSDEEP

Submit Download

B.Tv1

Path \Users\Admin\AppData\Local\Temp\7zS085A0F86\B.Tv1
Size 2.3MB
SHA256 b5586a729e338c5ab432142a012e93386f3dab0d3e5587203926253be5ac76d4
MD5 cb6a3da7d75d249705b2ccba171c6c5b
SHA1 13e7771ac0f4103072f5a6aac43adcdba52bc86b
SHA512 68d4ddfb654418d1489903b4810d45376a58d2b857bf4d4d01e06a2f1b2ad879484ec68376c696e369d80c234afb3500e24c726e9ccaf760406e105327431105
SSDEEP 49152:EYUogIZSoCb0jVlHh7khGpwMGo2AfiJxB+lybUei:vXgIZvxHL+xjAfiJKli
MD5 SHA1 SHA512 SSDEEP

Submit Download

B.Tv1

Path \Users\Admin\AppData\Local\Temp\7zS085A0F86\B.Tv1
Size 2.3MB
SHA256 b5586a729e338c5ab432142a012e93386f3dab0d3e5587203926253be5ac76d4
MD5 cb6a3da7d75d249705b2ccba171c6c5b
SHA1 13e7771ac0f4103072f5a6aac43adcdba52bc86b
SHA512 68d4ddfb654418d1489903b4810d45376a58d2b857bf4d4d01e06a2f1b2ad879484ec68376c696e369d80c234afb3500e24c726e9ccaf760406e105327431105
SSDEEP 49152:EYUogIZSoCb0jVlHh7khGpwMGo2AfiJxB+lybUei:vXgIZvxHL+xjAfiJKli
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1064-16-0x0000000000100000-0x0000000000106000-memory.dmp

Download

memory/1064-23-0x00000000027B0000-0x00000000028B1000-memory.dmp

Download

memory/1064-24-0x00000000027B0000-0x00000000028B1000-memory.dmp

Download

memory/1064-17-0x0000000010000000-0x0000000010244000-memory.dmp

Download

memory/1064-19-0x0000000002690000-0x00000000027AB000-memory.dmp

Download

memory/1064-21-0x00000000027B0000-0x00000000028B1000-memory.dmp

Download

memory/1064-20-0x00000000027B0000-0x00000000028B1000-memory.dmp

Download

memory/2988-29-0x00000000001B0000-0x00000000001B6000-memory.dmp

Download

memory/2988-32-0x0000000002770000-0x000000000288B000-memory.dmp

Download

memory/2988-34-0x0000000002890000-0x0000000002991000-memory.dmp

Download

memory/2988-36-0x0000000002890000-0x0000000002991000-memory.dmp

Download

memory/2988-37-0x0000000002890000-0x0000000002991000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads