8d0191d24b9d62100603d7640fe138d5eb005f758fa77cbcf0434e317286db6c

Analysis

max time kernel
122s
max time network
139s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
30/09/2023, 13:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SecuriteInfo.com.Win32.Evo-gen.6656.15576.exe
Size 2.2MB
Sample230930-qrtcgseb35
SHA256 8d0191d24b9d62100603d7640fe138d5eb005f758fa77cbcf0434e317286db6c
MD5 779ff91d6893229708d97f21cb2c9e4d
SHA1 883889f130a26a11f02648849829d3ba0f208fb6
SHA512 a6d980415d7928934d83e6317e237f592c1aa605d2cbf40993ee56ff185a222019ad63bace07b728869eb8094aed34e9c078dc63ca16055c7a3a2b46cb935fe5
SSDEEP 49152:ufBudeLGQtMYIcoU9qia+cKu2RiviribhMTQvRkVejWEGEBG:reLfMiNc+uiubhKf7SG
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 8 IoCs

pid	Process
2116	rundll32.exe
2116	rundll32.exe
2116	rundll32.exe
2116	rundll32.exe
2700	rundll32.exe
2700	rundll32.exe
2700	rundll32.exe
2700	rundll32.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 1732 wrote to memory of 2056	1732	SecuriteInfo.com.Win32.Evo-gen.6656.15576.exe	27
PID 1732 wrote to memory of 2056	1732	SecuriteInfo.com.Win32.Evo-gen.6656.15576.exe	27
PID 1732 wrote to memory of 2056	1732	SecuriteInfo.com.Win32.Evo-gen.6656.15576.exe	27
PID 1732 wrote to memory of 2056	1732	SecuriteInfo.com.Win32.Evo-gen.6656.15576.exe	27
PID 2056 wrote to memory of 1984	2056	cmd.exe	29
PID 2056 wrote to memory of 1984	2056	cmd.exe	29
PID 2056 wrote to memory of 1984	2056	cmd.exe	29
PID 2056 wrote to memory of 1984	2056	cmd.exe	29
PID 1984 wrote to memory of 2116	1984	control.exe	30
PID 1984 wrote to memory of 2116	1984	control.exe	30
PID 1984 wrote to memory of 2116	1984	control.exe	30
PID 1984 wrote to memory of 2116	1984	control.exe	30
PID 1984 wrote to memory of 2116	1984	control.exe	30
PID 1984 wrote to memory of 2116	1984	control.exe	30
PID 1984 wrote to memory of 2116	1984	control.exe	30
PID 2116 wrote to memory of 2748	2116	rundll32.exe	31
PID 2116 wrote to memory of 2748	2116	rundll32.exe	31
PID 2116 wrote to memory of 2748	2116	rundll32.exe	31
PID 2116 wrote to memory of 2748	2116	rundll32.exe	31
PID 2748 wrote to memory of 2700	2748	RunDll32.exe	32
PID 2748 wrote to memory of 2700	2748	RunDll32.exe	32
PID 2748 wrote to memory of 2700	2748	RunDll32.exe	32
PID 2748 wrote to memory of 2700	2748	RunDll32.exe	32
PID 2748 wrote to memory of 2700	2748	RunDll32.exe	32
PID 2748 wrote to memory of 2700	2748	RunDll32.exe	32
PID 2748 wrote to memory of 2700	2748	RunDll32.exe	32

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.Evo-gen.6656.15576.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.Evo-gen.6656.15576.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1732
- C:\Windows\SysWOW64\cmd.exe
  cmd /c .\YY~.bAT
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2056
- - C:\Windows\SysWOW64\control.exe
    ContRoL "C:\Users\Admin\AppData\Local\Temp\7zS4C6BDEA6\OvGaA9.YH"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1984
  - - C:\Windows\SysWOW64\rundll32.exe
      "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\7zS4C6BDEA6\OvGaA9.YH"
      4⤵
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:2116
    - - C:\Windows\system32\RunDll32.exe
        
        C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\7zS4C6BDEA6\OvGaA9.YH"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2748
      - C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 "C:\Users\Admin\AppData\Local\Temp\7zS4C6BDEA6\OvGaA9.YH"
        6⤵
        Loads dropped DLL
        
        PID:2700

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

OvGaA9.YH

Path C:\Users\Admin\AppData\Local\Temp\7zS4C6BDEA6\OvGaA9.YH
Size 2.3MB
SHA256 73cf2b099ff17a5ab34c669c5c29e58c33e2db003d0be302c6f5ebbe1347316d
MD5 569f413b4e23919c28e91991e75ed6c0
SHA1 a6562ded36d587a49f20892655f4be07bbd68bee
SHA512 6b544b1ce79bfb543363fa12d3c281735d7c2518238eeb2ebcc4d06613850a61ee808e5108583212b685f9da03668175402d46d8d538423ce7630c26c9f417ca
SSDEEP 24576:FuvPSMa6qWXTx5dVWE5kfg593ehV5cdhsL+h7hDO70GGqThVjmgGh3CwRJx9B1R5:FuvPS4qqHefjEW27hOGqVqgCrDpRJ+M
MD5 SHA1 SHA512 SSDEEP

Submit Download

YY~.bat

Path C:\Users\Admin\AppData\Local\Temp\7zS4C6BDEA6\YY~.bat
Size 26B
SHA256 bf287b3e197182b3944b8fcbbbf5bd6c6a1bc0d58b3d8ee6780d8aa21fc4991b
MD5 17d997202b56790cfe9fd7811bbf7554
SHA1 407f264a7313a5881efe56a580d0d54623652391
SHA512 d2760ed6edea97eeb3e52b33e0414d8eebddbe396631fe5fddd7d9f825bc073b194d61acd143bbe23c70844a638355ebb6c0e258b104290f04b71781df5a8ad9
MD5 SHA1 SHA512

Submit Download

YY~.bat

Path C:\Users\Admin\AppData\Local\Temp\7zS4C6BDEA6\YY~.bat
Size 26B
SHA256 bf287b3e197182b3944b8fcbbbf5bd6c6a1bc0d58b3d8ee6780d8aa21fc4991b
MD5 17d997202b56790cfe9fd7811bbf7554
SHA1 407f264a7313a5881efe56a580d0d54623652391
SHA512 d2760ed6edea97eeb3e52b33e0414d8eebddbe396631fe5fddd7d9f825bc073b194d61acd143bbe23c70844a638355ebb6c0e258b104290f04b71781df5a8ad9
MD5 SHA1 SHA512

Submit Download

OvGaa9.yh

Path \Users\Admin\AppData\Local\Temp\7zS4C6BDEA6\OvGaa9.yh
Size 2.3MB
SHA256 73cf2b099ff17a5ab34c669c5c29e58c33e2db003d0be302c6f5ebbe1347316d
MD5 569f413b4e23919c28e91991e75ed6c0
SHA1 a6562ded36d587a49f20892655f4be07bbd68bee
SHA512 6b544b1ce79bfb543363fa12d3c281735d7c2518238eeb2ebcc4d06613850a61ee808e5108583212b685f9da03668175402d46d8d538423ce7630c26c9f417ca
SSDEEP 24576:FuvPSMa6qWXTx5dVWE5kfg593ehV5cdhsL+h7hDO70GGqThVjmgGh3CwRJx9B1R5:FuvPS4qqHefjEW27hOGqVqgCrDpRJ+M
MD5 SHA1 SHA512 SSDEEP

Submit Download

OvGaa9.yh

Path \Users\Admin\AppData\Local\Temp\7zS4C6BDEA6\OvGaa9.yh
Size 2.3MB
SHA256 73cf2b099ff17a5ab34c669c5c29e58c33e2db003d0be302c6f5ebbe1347316d
MD5 569f413b4e23919c28e91991e75ed6c0
SHA1 a6562ded36d587a49f20892655f4be07bbd68bee
SHA512 6b544b1ce79bfb543363fa12d3c281735d7c2518238eeb2ebcc4d06613850a61ee808e5108583212b685f9da03668175402d46d8d538423ce7630c26c9f417ca
SSDEEP 24576:FuvPSMa6qWXTx5dVWE5kfg593ehV5cdhsL+h7hDO70GGqThVjmgGh3CwRJx9B1R5:FuvPS4qqHefjEW27hOGqVqgCrDpRJ+M
MD5 SHA1 SHA512 SSDEEP

Submit Download

OvGaa9.yh

Path \Users\Admin\AppData\Local\Temp\7zS4C6BDEA6\OvGaa9.yh
Size 2.3MB
SHA256 73cf2b099ff17a5ab34c669c5c29e58c33e2db003d0be302c6f5ebbe1347316d
MD5 569f413b4e23919c28e91991e75ed6c0
SHA1 a6562ded36d587a49f20892655f4be07bbd68bee
SHA512 6b544b1ce79bfb543363fa12d3c281735d7c2518238eeb2ebcc4d06613850a61ee808e5108583212b685f9da03668175402d46d8d538423ce7630c26c9f417ca
SSDEEP 24576:FuvPSMa6qWXTx5dVWE5kfg593ehV5cdhsL+h7hDO70GGqThVjmgGh3CwRJx9B1R5:FuvPS4qqHefjEW27hOGqVqgCrDpRJ+M
MD5 SHA1 SHA512 SSDEEP

Submit Download

OvGaa9.yh

Path \Users\Admin\AppData\Local\Temp\7zS4C6BDEA6\OvGaa9.yh
Size 2.3MB
SHA256 73cf2b099ff17a5ab34c669c5c29e58c33e2db003d0be302c6f5ebbe1347316d
MD5 569f413b4e23919c28e91991e75ed6c0
SHA1 a6562ded36d587a49f20892655f4be07bbd68bee
SHA512 6b544b1ce79bfb543363fa12d3c281735d7c2518238eeb2ebcc4d06613850a61ee808e5108583212b685f9da03668175402d46d8d538423ce7630c26c9f417ca
SSDEEP 24576:FuvPSMa6qWXTx5dVWE5kfg593ehV5cdhsL+h7hDO70GGqThVjmgGh3CwRJx9B1R5:FuvPS4qqHefjEW27hOGqVqgCrDpRJ+M
MD5 SHA1 SHA512 SSDEEP

Submit Download

OvGaa9.yh

Path \Users\Admin\AppData\Local\Temp\7zS4C6BDEA6\OvGaa9.yh
Size 2.3MB
SHA256 73cf2b099ff17a5ab34c669c5c29e58c33e2db003d0be302c6f5ebbe1347316d
MD5 569f413b4e23919c28e91991e75ed6c0
SHA1 a6562ded36d587a49f20892655f4be07bbd68bee
SHA512 6b544b1ce79bfb543363fa12d3c281735d7c2518238eeb2ebcc4d06613850a61ee808e5108583212b685f9da03668175402d46d8d538423ce7630c26c9f417ca
SSDEEP 24576:FuvPSMa6qWXTx5dVWE5kfg593ehV5cdhsL+h7hDO70GGqThVjmgGh3CwRJx9B1R5:FuvPS4qqHefjEW27hOGqVqgCrDpRJ+M
MD5 SHA1 SHA512 SSDEEP

Submit Download

OvGaa9.yh

Path \Users\Admin\AppData\Local\Temp\7zS4C6BDEA6\OvGaa9.yh
Size 2.3MB
SHA256 73cf2b099ff17a5ab34c669c5c29e58c33e2db003d0be302c6f5ebbe1347316d
MD5 569f413b4e23919c28e91991e75ed6c0
SHA1 a6562ded36d587a49f20892655f4be07bbd68bee
SHA512 6b544b1ce79bfb543363fa12d3c281735d7c2518238eeb2ebcc4d06613850a61ee808e5108583212b685f9da03668175402d46d8d538423ce7630c26c9f417ca
SSDEEP 24576:FuvPSMa6qWXTx5dVWE5kfg593ehV5cdhsL+h7hDO70GGqThVjmgGh3CwRJx9B1R5:FuvPS4qqHefjEW27hOGqVqgCrDpRJ+M
MD5 SHA1 SHA512 SSDEEP

Submit Download

OvGaa9.yh

Path \Users\Admin\AppData\Local\Temp\7zS4C6BDEA6\OvGaa9.yh
Size 2.3MB
SHA256 73cf2b099ff17a5ab34c669c5c29e58c33e2db003d0be302c6f5ebbe1347316d
MD5 569f413b4e23919c28e91991e75ed6c0
SHA1 a6562ded36d587a49f20892655f4be07bbd68bee
SHA512 6b544b1ce79bfb543363fa12d3c281735d7c2518238eeb2ebcc4d06613850a61ee808e5108583212b685f9da03668175402d46d8d538423ce7630c26c9f417ca
SSDEEP 24576:FuvPSMa6qWXTx5dVWE5kfg593ehV5cdhsL+h7hDO70GGqThVjmgGh3CwRJx9B1R5:FuvPS4qqHefjEW27hOGqVqgCrDpRJ+M
MD5 SHA1 SHA512 SSDEEP

Submit Download

OvGaa9.yh

Path \Users\Admin\AppData\Local\Temp\7zS4C6BDEA6\OvGaa9.yh
Size 2.3MB
SHA256 73cf2b099ff17a5ab34c669c5c29e58c33e2db003d0be302c6f5ebbe1347316d
MD5 569f413b4e23919c28e91991e75ed6c0
SHA1 a6562ded36d587a49f20892655f4be07bbd68bee
SHA512 6b544b1ce79bfb543363fa12d3c281735d7c2518238eeb2ebcc4d06613850a61ee808e5108583212b685f9da03668175402d46d8d538423ce7630c26c9f417ca
SSDEEP 24576:FuvPSMa6qWXTx5dVWE5kfg593ehV5cdhsL+h7hDO70GGqThVjmgGh3CwRJx9B1R5:FuvPS4qqHefjEW27hOGqVqgCrDpRJ+M
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2116-21-0x00000000027A0000-0x0000000002895000-memory.dmp

Download

memory/2116-23-0x00000000027A0000-0x0000000002895000-memory.dmp

Download

memory/2116-24-0x00000000027A0000-0x0000000002895000-memory.dmp

Download

memory/2116-20-0x00000000027A0000-0x0000000002895000-memory.dmp

Download

memory/2116-16-0x0000000000170000-0x0000000000176000-memory.dmp

Download

memory/2116-19-0x0000000002300000-0x0000000002410000-memory.dmp

Download

memory/2116-17-0x0000000010000000-0x0000000010243000-memory.dmp

Download

memory/2700-30-0x0000000000130000-0x0000000000136000-memory.dmp

Download

memory/2700-32-0x0000000002640000-0x0000000002750000-memory.dmp

Download

memory/2700-34-0x0000000002750000-0x0000000002845000-memory.dmp

Download

memory/2700-36-0x0000000002750000-0x0000000002845000-memory.dmp

Download

memory/2700-37-0x0000000002750000-0x0000000002845000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads