657ce9b72278bcbc3d100ea8a012381ceee3402bcb19977befb69f4d7459275b

Analysis

max time kernel
117s
max time network
127s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
30/09/2023, 12:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SecuriteInfo.com.Win32.Evo-gen.12168.5292.exe
Size 2.2MB
Sample230930-ppg11adc53
SHA256 657ce9b72278bcbc3d100ea8a012381ceee3402bcb19977befb69f4d7459275b
MD5 deee84c40a180ea7a52aa09f240263b7
SHA1 3136c29e0019939a91e63611db1cfd34030286f4
SHA512 81c6dbdc1198c903850358b0cf473209b66723b7dc8bd0faa9dd8bdf5d6bbeffcfa07ccb6f5832718a9fe9b46ca5f9c054fd940444d1bbf9ef638fab738dda5d
SSDEEP 49152:uf14S1LNzSp9C/iVUfcN3c1Ry55HoBmq9wYPJ3uIFAxu0fnaJKdpWIWB:wrzSLCHfcJ5gbgIyRfaJm4z
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 8 IoCs

pid	Process
2528	rundll32.exe
2528	rundll32.exe
2528	rundll32.exe
2528	rundll32.exe
2432	rundll32.exe
2432	rundll32.exe
2432	rundll32.exe
2432	rundll32.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 2208 wrote to memory of 2668	2208	SecuriteInfo.com.Win32.Evo-gen.12168.5292.exe	28
PID 2208 wrote to memory of 2668	2208	SecuriteInfo.com.Win32.Evo-gen.12168.5292.exe	28
PID 2208 wrote to memory of 2668	2208	SecuriteInfo.com.Win32.Evo-gen.12168.5292.exe	28
PID 2208 wrote to memory of 2668	2208	SecuriteInfo.com.Win32.Evo-gen.12168.5292.exe	28
PID 2668 wrote to memory of 2664	2668	cmd.exe	30
PID 2668 wrote to memory of 2664	2668	cmd.exe	30
PID 2668 wrote to memory of 2664	2668	cmd.exe	30
PID 2668 wrote to memory of 2664	2668	cmd.exe	30
PID 2664 wrote to memory of 2528	2664	control.exe	31
PID 2664 wrote to memory of 2528	2664	control.exe	31
PID 2664 wrote to memory of 2528	2664	control.exe	31
PID 2664 wrote to memory of 2528	2664	control.exe	31
PID 2664 wrote to memory of 2528	2664	control.exe	31
PID 2664 wrote to memory of 2528	2664	control.exe	31
PID 2664 wrote to memory of 2528	2664	control.exe	31
PID 2528 wrote to memory of 2800	2528	rundll32.exe	32
PID 2528 wrote to memory of 2800	2528	rundll32.exe	32
PID 2528 wrote to memory of 2800	2528	rundll32.exe	32
PID 2528 wrote to memory of 2800	2528	rundll32.exe	32
PID 2800 wrote to memory of 2432	2800	RunDll32.exe	33
PID 2800 wrote to memory of 2432	2800	RunDll32.exe	33
PID 2800 wrote to memory of 2432	2800	RunDll32.exe	33
PID 2800 wrote to memory of 2432	2800	RunDll32.exe	33
PID 2800 wrote to memory of 2432	2800	RunDll32.exe	33
PID 2800 wrote to memory of 2432	2800	RunDll32.exe	33
PID 2800 wrote to memory of 2432	2800	RunDll32.exe	33

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.Evo-gen.12168.5292.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.Evo-gen.12168.5292.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2208
- C:\Windows\SysWOW64\cmd.exe
  cmd /c .\a.Cmd
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2668
- - C:\Windows\SysWOW64\control.exe
    contRoL.eXe "C:\Users\Admin\AppData\Local\Temp\7zS0A8DD6A6\P7P3LN.i2i"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2664
  - - C:\Windows\SysWOW64\rundll32.exe
      "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\7zS0A8DD6A6\P7P3LN.i2i"
      4⤵
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:2528
    - - C:\Windows\system32\RunDll32.exe
        
        C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\7zS0A8DD6A6\P7P3LN.i2i"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2800
      - C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 "C:\Users\Admin\AppData\Local\Temp\7zS0A8DD6A6\P7P3LN.i2i"
        6⤵
        Loads dropped DLL
        
        PID:2432

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

P7P3LN.i2i

Path C:\Users\Admin\AppData\Local\Temp\7zS0A8DD6A6\P7P3LN.i2i
Size 2.3MB
SHA256 fb5eab23b8b15e5b9632e3f7d18367f7f56a29ea09da5248be5c5a415af0cddd
MD5 c6b2bedd417af83871a83fe1043e0136
SHA1 18187563aea30cf91ce00723b1bfb79f0cd84259
SHA512 006cac3bce9090ee5076f6a9378f6b233697592765f7002e1bee29c462ee5a1fd387a77265d99dafbb6e340b90381b0935cc000978dd7ee4434f99d9ff219a74
SSDEEP 49152:x157uFpts/idNfcN3P1RX5vpABHq4TvG+39IFKxuTWHSaJdpWZW4:5uF7sGfcDvM6WIw8Wya34
MD5 SHA1 SHA512 SSDEEP

Submit Download

a.cmd

Path C:\Users\Admin\AppData\Local\Temp\7zS0A8DD6A6\a.cmd
Size 29B
SHA256 61cc7f0dee5df2693404b4090064eefb6788a7e4791cf697ce25e3dcb4b9a4c0
MD5 82c18a0eab9dc2a470800a607da8b691
SHA1 925a8956a499051f73a2075598a30326cb7ec955
SHA512 d54c8918739a54c886a0e716eb93d4146dc5a383cce3a14ef644718c9b4d8439ef12892e8375c3cfc2ed68016ecaaa41afcf30df1f63d327704d415ef9cc2082
MD5 SHA1 SHA512

Submit Download

a.cmd

Path C:\Users\Admin\AppData\Local\Temp\7zS0A8DD6A6\a.cmd
Size 29B
SHA256 61cc7f0dee5df2693404b4090064eefb6788a7e4791cf697ce25e3dcb4b9a4c0
MD5 82c18a0eab9dc2a470800a607da8b691
SHA1 925a8956a499051f73a2075598a30326cb7ec955
SHA512 d54c8918739a54c886a0e716eb93d4146dc5a383cce3a14ef644718c9b4d8439ef12892e8375c3cfc2ed68016ecaaa41afcf30df1f63d327704d415ef9cc2082
MD5 SHA1 SHA512

Submit Download

p7P3lN.i2i

Path \Users\Admin\AppData\Local\Temp\7zS0A8DD6A6\p7P3lN.i2i
Size 2.3MB
SHA256 fb5eab23b8b15e5b9632e3f7d18367f7f56a29ea09da5248be5c5a415af0cddd
MD5 c6b2bedd417af83871a83fe1043e0136
SHA1 18187563aea30cf91ce00723b1bfb79f0cd84259
SHA512 006cac3bce9090ee5076f6a9378f6b233697592765f7002e1bee29c462ee5a1fd387a77265d99dafbb6e340b90381b0935cc000978dd7ee4434f99d9ff219a74
SSDEEP 49152:x157uFpts/idNfcN3P1RX5vpABHq4TvG+39IFKxuTWHSaJdpWZW4:5uF7sGfcDvM6WIw8Wya34
MD5 SHA1 SHA512 SSDEEP

Submit Download

p7P3lN.i2i

Path \Users\Admin\AppData\Local\Temp\7zS0A8DD6A6\p7P3lN.i2i
Size 2.3MB
SHA256 fb5eab23b8b15e5b9632e3f7d18367f7f56a29ea09da5248be5c5a415af0cddd
MD5 c6b2bedd417af83871a83fe1043e0136
SHA1 18187563aea30cf91ce00723b1bfb79f0cd84259
SHA512 006cac3bce9090ee5076f6a9378f6b233697592765f7002e1bee29c462ee5a1fd387a77265d99dafbb6e340b90381b0935cc000978dd7ee4434f99d9ff219a74
SSDEEP 49152:x157uFpts/idNfcN3P1RX5vpABHq4TvG+39IFKxuTWHSaJdpWZW4:5uF7sGfcDvM6WIw8Wya34
MD5 SHA1 SHA512 SSDEEP

Submit Download

p7P3lN.i2i

Path \Users\Admin\AppData\Local\Temp\7zS0A8DD6A6\p7P3lN.i2i
Size 2.3MB
SHA256 fb5eab23b8b15e5b9632e3f7d18367f7f56a29ea09da5248be5c5a415af0cddd
MD5 c6b2bedd417af83871a83fe1043e0136
SHA1 18187563aea30cf91ce00723b1bfb79f0cd84259
SHA512 006cac3bce9090ee5076f6a9378f6b233697592765f7002e1bee29c462ee5a1fd387a77265d99dafbb6e340b90381b0935cc000978dd7ee4434f99d9ff219a74
SSDEEP 49152:x157uFpts/idNfcN3P1RX5vpABHq4TvG+39IFKxuTWHSaJdpWZW4:5uF7sGfcDvM6WIw8Wya34
MD5 SHA1 SHA512 SSDEEP

Submit Download

p7P3lN.i2i

Path \Users\Admin\AppData\Local\Temp\7zS0A8DD6A6\p7P3lN.i2i
Size 2.3MB
SHA256 fb5eab23b8b15e5b9632e3f7d18367f7f56a29ea09da5248be5c5a415af0cddd
MD5 c6b2bedd417af83871a83fe1043e0136
SHA1 18187563aea30cf91ce00723b1bfb79f0cd84259
SHA512 006cac3bce9090ee5076f6a9378f6b233697592765f7002e1bee29c462ee5a1fd387a77265d99dafbb6e340b90381b0935cc000978dd7ee4434f99d9ff219a74
SSDEEP 49152:x157uFpts/idNfcN3P1RX5vpABHq4TvG+39IFKxuTWHSaJdpWZW4:5uF7sGfcDvM6WIw8Wya34
MD5 SHA1 SHA512 SSDEEP

Submit Download

p7P3lN.i2i

Path \Users\Admin\AppData\Local\Temp\7zS0A8DD6A6\p7P3lN.i2i
Size 2.3MB
SHA256 fb5eab23b8b15e5b9632e3f7d18367f7f56a29ea09da5248be5c5a415af0cddd
MD5 c6b2bedd417af83871a83fe1043e0136
SHA1 18187563aea30cf91ce00723b1bfb79f0cd84259
SHA512 006cac3bce9090ee5076f6a9378f6b233697592765f7002e1bee29c462ee5a1fd387a77265d99dafbb6e340b90381b0935cc000978dd7ee4434f99d9ff219a74
SSDEEP 49152:x157uFpts/idNfcN3P1RX5vpABHq4TvG+39IFKxuTWHSaJdpWZW4:5uF7sGfcDvM6WIw8Wya34
MD5 SHA1 SHA512 SSDEEP

Submit Download

p7P3lN.i2i

Path \Users\Admin\AppData\Local\Temp\7zS0A8DD6A6\p7P3lN.i2i
Size 2.3MB
SHA256 fb5eab23b8b15e5b9632e3f7d18367f7f56a29ea09da5248be5c5a415af0cddd
MD5 c6b2bedd417af83871a83fe1043e0136
SHA1 18187563aea30cf91ce00723b1bfb79f0cd84259
SHA512 006cac3bce9090ee5076f6a9378f6b233697592765f7002e1bee29c462ee5a1fd387a77265d99dafbb6e340b90381b0935cc000978dd7ee4434f99d9ff219a74
SSDEEP 49152:x157uFpts/idNfcN3P1RX5vpABHq4TvG+39IFKxuTWHSaJdpWZW4:5uF7sGfcDvM6WIw8Wya34
MD5 SHA1 SHA512 SSDEEP

Submit Download

p7P3lN.i2i

Path \Users\Admin\AppData\Local\Temp\7zS0A8DD6A6\p7P3lN.i2i
Size 2.3MB
SHA256 fb5eab23b8b15e5b9632e3f7d18367f7f56a29ea09da5248be5c5a415af0cddd
MD5 c6b2bedd417af83871a83fe1043e0136
SHA1 18187563aea30cf91ce00723b1bfb79f0cd84259
SHA512 006cac3bce9090ee5076f6a9378f6b233697592765f7002e1bee29c462ee5a1fd387a77265d99dafbb6e340b90381b0935cc000978dd7ee4434f99d9ff219a74
SSDEEP 49152:x157uFpts/idNfcN3P1RX5vpABHq4TvG+39IFKxuTWHSaJdpWZW4:5uF7sGfcDvM6WIw8Wya34
MD5 SHA1 SHA512 SSDEEP

Submit Download

p7P3lN.i2i

Path \Users\Admin\AppData\Local\Temp\7zS0A8DD6A6\p7P3lN.i2i
Size 2.3MB
SHA256 fb5eab23b8b15e5b9632e3f7d18367f7f56a29ea09da5248be5c5a415af0cddd
MD5 c6b2bedd417af83871a83fe1043e0136
SHA1 18187563aea30cf91ce00723b1bfb79f0cd84259
SHA512 006cac3bce9090ee5076f6a9378f6b233697592765f7002e1bee29c462ee5a1fd387a77265d99dafbb6e340b90381b0935cc000978dd7ee4434f99d9ff219a74
SSDEEP 49152:x157uFpts/idNfcN3P1RX5vpABHq4TvG+39IFKxuTWHSaJdpWZW4:5uF7sGfcDvM6WIw8Wya34
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2432-30-0x00000000000C0000-0x00000000000C6000-memory.dmp

Download

memory/2432-37-0x00000000026A0000-0x0000000002795000-memory.dmp

Download

memory/2432-36-0x00000000026A0000-0x0000000002795000-memory.dmp

Download

memory/2432-34-0x00000000026A0000-0x0000000002795000-memory.dmp

Download

memory/2432-32-0x0000000002320000-0x0000000002430000-memory.dmp

Download

memory/2528-24-0x0000000002710000-0x0000000002805000-memory.dmp

Download

memory/2528-16-0x00000000001B0000-0x00000000001B6000-memory.dmp

Download

memory/2528-17-0x0000000010000000-0x0000000010244000-memory.dmp

Download

memory/2528-19-0x0000000002600000-0x0000000002710000-memory.dmp

Download

memory/2528-20-0x0000000002710000-0x0000000002805000-memory.dmp

Download

memory/2528-23-0x0000000002710000-0x0000000002805000-memory.dmp

Download

memory/2528-21-0x0000000002710000-0x0000000002805000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads