8d0191d24b9d62100603d7640fe138d5eb005f758fa77cbcf0434e317286db6c

Analysis

max time kernel
139s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
30/09/2023, 13:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SecuriteInfo.com.Win32.Evo-gen.6656.15576.exe
Size 2.2MB
Sample230930-qrtcgseb35
SHA256 8d0191d24b9d62100603d7640fe138d5eb005f758fa77cbcf0434e317286db6c
MD5 779ff91d6893229708d97f21cb2c9e4d
SHA1 883889f130a26a11f02648849829d3ba0f208fb6
SHA512 a6d980415d7928934d83e6317e237f592c1aa605d2cbf40993ee56ff185a222019ad63bace07b728869eb8094aed34e9c078dc63ca16055c7a3a2b46cb935fe5
SSDEEP 49152:ufBudeLGQtMYIcoU9qia+cKu2RiviribhMTQvRkVejWEGEBG:reLfMiNc+uiubhKf7SG
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
3768	rundll32.exe
788	rundll32.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 2260 wrote to memory of 1576	2260	SecuriteInfo.com.Win32.Evo-gen.6656.15576.exe	83
PID 2260 wrote to memory of 1576	2260	SecuriteInfo.com.Win32.Evo-gen.6656.15576.exe	83
PID 2260 wrote to memory of 1576	2260	SecuriteInfo.com.Win32.Evo-gen.6656.15576.exe	83
PID 1576 wrote to memory of 1064	1576	cmd.exe	85
PID 1576 wrote to memory of 1064	1576	cmd.exe	85
PID 1576 wrote to memory of 1064	1576	cmd.exe	85
PID 1064 wrote to memory of 3768	1064	control.exe	87
PID 1064 wrote to memory of 3768	1064	control.exe	87
PID 1064 wrote to memory of 3768	1064	control.exe	87
PID 3768 wrote to memory of 4120	3768	rundll32.exe	90
PID 3768 wrote to memory of 4120	3768	rundll32.exe	90
PID 4120 wrote to memory of 788	4120	RunDll32.exe	91
PID 4120 wrote to memory of 788	4120	RunDll32.exe	91
PID 4120 wrote to memory of 788	4120	RunDll32.exe	91

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.Evo-gen.6656.15576.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.Evo-gen.6656.15576.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2260
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c .\YY~.bAT
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1576
- - C:\Windows\SysWOW64\control.exe
    ContRoL "C:\Users\Admin\AppData\Local\Temp\7zS4D831387\OvGaA9.YH"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1064
  - - C:\Windows\SysWOW64\rundll32.exe
      "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\7zS4D831387\OvGaA9.YH"
      4⤵
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:3768
    - - C:\Windows\system32\RunDll32.exe
        
        C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\7zS4D831387\OvGaA9.YH"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4120
      - C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 "C:\Users\Admin\AppData\Local\Temp\7zS4D831387\OvGaA9.YH"
        6⤵
        Loads dropped DLL
        
        PID:788

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

OvGaA9.YH

Path C:\Users\Admin\AppData\Local\Temp\7zS4D831387\OvGaA9.YH
Size 2.3MB
SHA256 73cf2b099ff17a5ab34c669c5c29e58c33e2db003d0be302c6f5ebbe1347316d
MD5 569f413b4e23919c28e91991e75ed6c0
SHA1 a6562ded36d587a49f20892655f4be07bbd68bee
SHA512 6b544b1ce79bfb543363fa12d3c281735d7c2518238eeb2ebcc4d06613850a61ee808e5108583212b685f9da03668175402d46d8d538423ce7630c26c9f417ca
SSDEEP 24576:FuvPSMa6qWXTx5dVWE5kfg593ehV5cdhsL+h7hDO70GGqThVjmgGh3CwRJx9B1R5:FuvPS4qqHefjEW27hOGqVqgCrDpRJ+M
MD5 SHA1 SHA512 SSDEEP

Submit Download

OvGaa9.yh

Path C:\Users\Admin\AppData\Local\Temp\7zS4D831387\OvGaa9.yh
Size 2.3MB
SHA256 73cf2b099ff17a5ab34c669c5c29e58c33e2db003d0be302c6f5ebbe1347316d
MD5 569f413b4e23919c28e91991e75ed6c0
SHA1 a6562ded36d587a49f20892655f4be07bbd68bee
SHA512 6b544b1ce79bfb543363fa12d3c281735d7c2518238eeb2ebcc4d06613850a61ee808e5108583212b685f9da03668175402d46d8d538423ce7630c26c9f417ca
SSDEEP 24576:FuvPSMa6qWXTx5dVWE5kfg593ehV5cdhsL+h7hDO70GGqThVjmgGh3CwRJx9B1R5:FuvPS4qqHefjEW27hOGqVqgCrDpRJ+M
MD5 SHA1 SHA512 SSDEEP

Submit Download

OvGaa9.yh

Path C:\Users\Admin\AppData\Local\Temp\7zS4D831387\OvGaa9.yh
Size 2.3MB
SHA256 73cf2b099ff17a5ab34c669c5c29e58c33e2db003d0be302c6f5ebbe1347316d
MD5 569f413b4e23919c28e91991e75ed6c0
SHA1 a6562ded36d587a49f20892655f4be07bbd68bee
SHA512 6b544b1ce79bfb543363fa12d3c281735d7c2518238eeb2ebcc4d06613850a61ee808e5108583212b685f9da03668175402d46d8d538423ce7630c26c9f417ca
SSDEEP 24576:FuvPSMa6qWXTx5dVWE5kfg593ehV5cdhsL+h7hDO70GGqThVjmgGh3CwRJx9B1R5:FuvPS4qqHefjEW27hOGqVqgCrDpRJ+M
MD5 SHA1 SHA512 SSDEEP

Submit Download

YY~.bat

Path C:\Users\Admin\AppData\Local\Temp\7zS4D831387\YY~.bat
Size 26B
SHA256 bf287b3e197182b3944b8fcbbbf5bd6c6a1bc0d58b3d8ee6780d8aa21fc4991b
MD5 17d997202b56790cfe9fd7811bbf7554
SHA1 407f264a7313a5881efe56a580d0d54623652391
SHA512 d2760ed6edea97eeb3e52b33e0414d8eebddbe396631fe5fddd7d9f825bc073b194d61acd143bbe23c70844a638355ebb6c0e258b104290f04b71781df5a8ad9
MD5 SHA1 SHA512

Submit Download

memory/788-26-0x0000000002990000-0x0000000002A85000-memory.dmp

Download

memory/788-25-0x0000000002990000-0x0000000002A85000-memory.dmp

Download

memory/788-23-0x0000000002990000-0x0000000002A85000-memory.dmp

Download

memory/788-21-0x0000000002880000-0x0000000002990000-memory.dmp

Download

memory/788-18-0x0000000000770000-0x0000000000776000-memory.dmp

Download

memory/3768-9-0x0000000010000000-0x0000000010243000-memory.dmp

Download

memory/3768-16-0x0000000002D80000-0x0000000002E75000-memory.dmp

Download

memory/3768-15-0x0000000002D80000-0x0000000002E75000-memory.dmp

Download

memory/3768-13-0x0000000002D80000-0x0000000002E75000-memory.dmp

Download

memory/3768-12-0x0000000002D80000-0x0000000002E75000-memory.dmp

Download

memory/3768-11-0x0000000002C60000-0x0000000002D70000-memory.dmp

Download

memory/3768-8-0x0000000002B10000-0x0000000002B16000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads