da9556ef3fd609709cc07f635978b1d428cd8bd681ebbe1679b5f7c10fa0270e

Analysis

max time kernel
140s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
30/09/2023, 04:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SecuriteInfo.com.Win32.Evo-gen.4881.25839.exe
Size 2.2MB
Sample230930-e4tcgaab78
SHA256 da9556ef3fd609709cc07f635978b1d428cd8bd681ebbe1679b5f7c10fa0270e
MD5 e4c9538ee2e50662bf7c2b701b8d1e57
SHA1 0be1f4fb075866dac9138b1aa3ab2e1586915528
SHA512 2790eb7cd8f5c0b5fe881322fc0a1775b631f26d2bd4444a1c875c3a49fbe1500b0419ba73e098867f333f93cc646e749d3018585cd475f423dc8b3810339955
SSDEEP 49152:ufaq87bBVQ+dZWakWcQIDI5eYB7HiP9kqvpQ1FRjro:ZpzZTZDCPGiQ1no
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
2480	rundll32.exe
4992	rundll32.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 2712 wrote to memory of 4492	2712	SecuriteInfo.com.Win32.Evo-gen.4881.25839.exe	83
PID 2712 wrote to memory of 4492	2712	SecuriteInfo.com.Win32.Evo-gen.4881.25839.exe	83
PID 2712 wrote to memory of 4492	2712	SecuriteInfo.com.Win32.Evo-gen.4881.25839.exe	83
PID 4492 wrote to memory of 4708	4492	cmd.exe	85
PID 4492 wrote to memory of 4708	4492	cmd.exe	85
PID 4492 wrote to memory of 4708	4492	cmd.exe	85
PID 4708 wrote to memory of 2480	4708	control.exe	87
PID 4708 wrote to memory of 2480	4708	control.exe	87
PID 4708 wrote to memory of 2480	4708	control.exe	87
PID 2480 wrote to memory of 3792	2480	rundll32.exe	90
PID 2480 wrote to memory of 3792	2480	rundll32.exe	90
PID 3792 wrote to memory of 4992	3792	RunDll32.exe	91
PID 3792 wrote to memory of 4992	3792	RunDll32.exe	91
PID 3792 wrote to memory of 4992	3792	RunDll32.exe	91

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.Evo-gen.4881.25839.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.Evo-gen.4881.25839.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2712
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c .\6MXMQ.BAT
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4492
- - C:\Windows\SysWOW64\control.exe
    CONtRol "C:\Users\Admin\AppData\Local\Temp\7zS89ABC3F7\B.Tv1"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4708
  - - C:\Windows\SysWOW64\rundll32.exe
      "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\7zS89ABC3F7\B.Tv1"
      4⤵
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:2480
    - - C:\Windows\system32\RunDll32.exe
        
        C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\7zS89ABC3F7\B.Tv1"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3792
      - C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 "C:\Users\Admin\AppData\Local\Temp\7zS89ABC3F7\B.Tv1"
        6⤵
        Loads dropped DLL
        
        PID:4992

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

6MXmQ.bat

Path C:\Users\Admin\AppData\Local\Temp\7zS89ABC3F7\6MXmQ.bat
Size 23B
SHA256 8acad9bfb6e60f33a4838402984c1e7fcf7391287c035d72d6a8130c4284f31b
MD5 a2dc6739541f40e7a865ceccc736bfa9
SHA1 ed3e534852b6cd952139a8040d2f6dca6c84fdc9
SHA512 65ffbe7a60aee7679f69d8ba465505220345675021967f83d61d669bc3ae9f6aa0a96e1098e815a5dce01b82492f780f215e834197cace204a51c7d73cadb8d7
MD5 SHA1 SHA512

Submit Download

B.Tv1

Path C:\Users\Admin\AppData\Local\Temp\7zS89ABC3F7\B.Tv1
Size 2.3MB
SHA256 b5586a729e338c5ab432142a012e93386f3dab0d3e5587203926253be5ac76d4
MD5 cb6a3da7d75d249705b2ccba171c6c5b
SHA1 13e7771ac0f4103072f5a6aac43adcdba52bc86b
SHA512 68d4ddfb654418d1489903b4810d45376a58d2b857bf4d4d01e06a2f1b2ad879484ec68376c696e369d80c234afb3500e24c726e9ccaf760406e105327431105
SSDEEP 49152:EYUogIZSoCb0jVlHh7khGpwMGo2AfiJxB+lybUei:vXgIZvxHL+xjAfiJKli
MD5 SHA1 SHA512 SSDEEP

Submit Download

B.Tv1

Path C:\Users\Admin\AppData\Local\Temp\7zS89ABC3F7\B.Tv1
Size 2.3MB
SHA256 b5586a729e338c5ab432142a012e93386f3dab0d3e5587203926253be5ac76d4
MD5 cb6a3da7d75d249705b2ccba171c6c5b
SHA1 13e7771ac0f4103072f5a6aac43adcdba52bc86b
SHA512 68d4ddfb654418d1489903b4810d45376a58d2b857bf4d4d01e06a2f1b2ad879484ec68376c696e369d80c234afb3500e24c726e9ccaf760406e105327431105
SSDEEP 49152:EYUogIZSoCb0jVlHh7khGpwMGo2AfiJxB+lybUei:vXgIZvxHL+xjAfiJKli
MD5 SHA1 SHA512 SSDEEP

Submit Download

B.Tv1

Path C:\Users\Admin\AppData\Local\Temp\7zS89ABC3F7\B.Tv1
Size 2.3MB
SHA256 b5586a729e338c5ab432142a012e93386f3dab0d3e5587203926253be5ac76d4
MD5 cb6a3da7d75d249705b2ccba171c6c5b
SHA1 13e7771ac0f4103072f5a6aac43adcdba52bc86b
SHA512 68d4ddfb654418d1489903b4810d45376a58d2b857bf4d4d01e06a2f1b2ad879484ec68376c696e369d80c234afb3500e24c726e9ccaf760406e105327431105
SSDEEP 49152:EYUogIZSoCb0jVlHh7khGpwMGo2AfiJxB+lybUei:vXgIZvxHL+xjAfiJKli
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2480-15-0x0000000002E40000-0x0000000002F41000-memory.dmp

Download

memory/2480-11-0x0000000002D20000-0x0000000002E3B000-memory.dmp

Download

memory/2480-13-0x0000000002E40000-0x0000000002F41000-memory.dmp

Download

memory/2480-12-0x0000000002E40000-0x0000000002F41000-memory.dmp

Download

memory/2480-9-0x0000000010000000-0x0000000010244000-memory.dmp

Download

memory/2480-16-0x0000000002E40000-0x0000000002F41000-memory.dmp

Download

memory/2480-8-0x0000000000D40000-0x0000000000D46000-memory.dmp

Download

memory/4992-18-0x0000000000BA0000-0x0000000000BA6000-memory.dmp

Download

memory/4992-21-0x0000000002970000-0x0000000002A8B000-memory.dmp

Download

memory/4992-23-0x0000000002A90000-0x0000000002B91000-memory.dmp

Download

memory/4992-25-0x0000000002A90000-0x0000000002B91000-memory.dmp

Download

memory/4992-26-0x0000000002A90000-0x0000000002B91000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads