b6c7f66593503ce7de53dec372a3407ab0c0ed221007eac96e44dd9b9488df0d

Analysis

max time kernel
119s
max time network
122s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
30/09/2023, 18:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SecuriteInfo.com.Gen.Variant.Mikey.154275.20256.24835.exe
Size 2.2MB
Sample230930-w92dpsgb97
SHA256 b6c7f66593503ce7de53dec372a3407ab0c0ed221007eac96e44dd9b9488df0d
MD5 b7db7a02a8590f38ba28dd5d4a75bd7b
SHA1 2f244bc5c19b10be3b35f6ebba3b75d12edadcbc
SHA512 7a5a595a8f827bef7172974d321c50ca579314b58d6692862a3747fdb9eda101d103d0891a0849995762f5cad86fead5231dad731ea36592d9b24ac540c50eaa
SSDEEP 49152:WfAm2sLxHoyUTWgvedeVU8yTtCKE6lW0Ez0q3MFS/sktK:WLnHaeQUNRCYlbgC
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 8 IoCs

pid	Process
2964	rundll32.exe
2964	rundll32.exe
2964	rundll32.exe
2964	rundll32.exe
2692	rundll32.exe
2692	rundll32.exe
2692	rundll32.exe
2692	rundll32.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 3020 wrote to memory of 2036	3020	SecuriteInfo.com.Gen.Variant.Mikey.154275.20256.24835.exe	28
PID 3020 wrote to memory of 2036	3020	SecuriteInfo.com.Gen.Variant.Mikey.154275.20256.24835.exe	28
PID 3020 wrote to memory of 2036	3020	SecuriteInfo.com.Gen.Variant.Mikey.154275.20256.24835.exe	28
PID 3020 wrote to memory of 2036	3020	SecuriteInfo.com.Gen.Variant.Mikey.154275.20256.24835.exe	28
PID 2036 wrote to memory of 1704	2036	cmd.exe	30
PID 2036 wrote to memory of 1704	2036	cmd.exe	30
PID 2036 wrote to memory of 1704	2036	cmd.exe	30
PID 2036 wrote to memory of 1704	2036	cmd.exe	30
PID 1704 wrote to memory of 2964	1704	control.exe	31
PID 1704 wrote to memory of 2964	1704	control.exe	31
PID 1704 wrote to memory of 2964	1704	control.exe	31
PID 1704 wrote to memory of 2964	1704	control.exe	31
PID 1704 wrote to memory of 2964	1704	control.exe	31
PID 1704 wrote to memory of 2964	1704	control.exe	31
PID 1704 wrote to memory of 2964	1704	control.exe	31
PID 2964 wrote to memory of 2764	2964	rundll32.exe	32
PID 2964 wrote to memory of 2764	2964	rundll32.exe	32
PID 2964 wrote to memory of 2764	2964	rundll32.exe	32
PID 2964 wrote to memory of 2764	2964	rundll32.exe	32
PID 2764 wrote to memory of 2692	2764	RunDll32.exe	33
PID 2764 wrote to memory of 2692	2764	RunDll32.exe	33
PID 2764 wrote to memory of 2692	2764	RunDll32.exe	33
PID 2764 wrote to memory of 2692	2764	RunDll32.exe	33
PID 2764 wrote to memory of 2692	2764	RunDll32.exe	33
PID 2764 wrote to memory of 2692	2764	RunDll32.exe	33
PID 2764 wrote to memory of 2692	2764	RunDll32.exe	33

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Gen.Variant.Mikey.154275.20256.24835.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Gen.Variant.Mikey.154275.20256.24835.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3020
- C:\Windows\SysWOW64\cmd.exe
  cmd /c .\xO77CPZ.bAT
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2036
- - C:\Windows\SysWOW64\control.exe
    COntROL "C:\Users\Admin\AppData\Local\Temp\7zSCCB81616\QUe3RU4z.f6"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1704
  - - C:\Windows\SysWOW64\rundll32.exe
      "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\7zSCCB81616\QUe3RU4z.f6"
      4⤵
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:2964
    - - C:\Windows\system32\RunDll32.exe
        
        C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\7zSCCB81616\QUe3RU4z.f6"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2764
      - C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 "C:\Users\Admin\AppData\Local\Temp\7zSCCB81616\QUe3RU4z.f6"
        6⤵
        Loads dropped DLL
        
        PID:2692

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

QUe3RU4z.f6

Path C:\Users\Admin\AppData\Local\Temp\7zSCCB81616\QUe3RU4z.f6
Size 2.3MB
SHA256 2e04be8a6b42f26774ab93c93f09d6e1dc4f39e7dfbcd941b87f8a8c35bcaf0d
MD5 83671c813cffa6dd9a8b2fafc5f9bd13
SHA1 5f27dc59cc5277068f2309fc2c759e8a1edf2942
SHA512 02a0a14a98a0ad567b816802937912f6e30eb3cac3e7b7ddce223f3815d4ea368a3403ca9d1fc7d250e5fe4a9fb0e6b698c25bd7fe009b6257e7ed4e88c08f66
SSDEEP 49152:MfVftowgBKtexb0+FCzQHz1nL4lQsoFnt7b3h+:OBgBQexb0zzMlnsoFnh3h
MD5 SHA1 SHA512 SSDEEP

Submit Download

xO77CpZ.bat

Path C:\Users\Admin\AppData\Local\Temp\7zSCCB81616\xO77CpZ.bat
Size 29B
SHA256 0a51a4776ebbcb84535d45031519af3d1da64f1e64127aeb286dbf942530bb11
MD5 b7d2b0c4a2668b61a5bd59c67de7c5f3
SHA1 d8f0d75dc9ad21b1719983b476675bcf85053c7c
SHA512 387aeac127c69c7651358ba1c11ced05292ef0815cf33f9a6c8fc88c100330d286a51ed7a7f1d74713bfc1a78837c8548ad0bd93d916a7eb780cb88cf242f655
MD5 SHA1 SHA512

Submit Download

xO77CpZ.bat

Path C:\Users\Admin\AppData\Local\Temp\7zSCCB81616\xO77CpZ.bat
Size 29B
SHA256 0a51a4776ebbcb84535d45031519af3d1da64f1e64127aeb286dbf942530bb11
MD5 b7d2b0c4a2668b61a5bd59c67de7c5f3
SHA1 d8f0d75dc9ad21b1719983b476675bcf85053c7c
SHA512 387aeac127c69c7651358ba1c11ced05292ef0815cf33f9a6c8fc88c100330d286a51ed7a7f1d74713bfc1a78837c8548ad0bd93d916a7eb780cb88cf242f655
MD5 SHA1 SHA512

Submit Download

QUe3RU4z.f6

Path \Users\Admin\AppData\Local\Temp\7zSCCB81616\QUe3RU4z.f6
Size 2.3MB
SHA256 2e04be8a6b42f26774ab93c93f09d6e1dc4f39e7dfbcd941b87f8a8c35bcaf0d
MD5 83671c813cffa6dd9a8b2fafc5f9bd13
SHA1 5f27dc59cc5277068f2309fc2c759e8a1edf2942
SHA512 02a0a14a98a0ad567b816802937912f6e30eb3cac3e7b7ddce223f3815d4ea368a3403ca9d1fc7d250e5fe4a9fb0e6b698c25bd7fe009b6257e7ed4e88c08f66
SSDEEP 49152:MfVftowgBKtexb0+FCzQHz1nL4lQsoFnt7b3h+:OBgBQexb0zzMlnsoFnh3h
MD5 SHA1 SHA512 SSDEEP

Submit Download

QUe3RU4z.f6

Path \Users\Admin\AppData\Local\Temp\7zSCCB81616\QUe3RU4z.f6
Size 2.3MB
SHA256 2e04be8a6b42f26774ab93c93f09d6e1dc4f39e7dfbcd941b87f8a8c35bcaf0d
MD5 83671c813cffa6dd9a8b2fafc5f9bd13
SHA1 5f27dc59cc5277068f2309fc2c759e8a1edf2942
SHA512 02a0a14a98a0ad567b816802937912f6e30eb3cac3e7b7ddce223f3815d4ea368a3403ca9d1fc7d250e5fe4a9fb0e6b698c25bd7fe009b6257e7ed4e88c08f66
SSDEEP 49152:MfVftowgBKtexb0+FCzQHz1nL4lQsoFnt7b3h+:OBgBQexb0zzMlnsoFnh3h
MD5 SHA1 SHA512 SSDEEP

Submit Download

QUe3RU4z.f6

Path \Users\Admin\AppData\Local\Temp\7zSCCB81616\QUe3RU4z.f6
Size 2.3MB
SHA256 2e04be8a6b42f26774ab93c93f09d6e1dc4f39e7dfbcd941b87f8a8c35bcaf0d
MD5 83671c813cffa6dd9a8b2fafc5f9bd13
SHA1 5f27dc59cc5277068f2309fc2c759e8a1edf2942
SHA512 02a0a14a98a0ad567b816802937912f6e30eb3cac3e7b7ddce223f3815d4ea368a3403ca9d1fc7d250e5fe4a9fb0e6b698c25bd7fe009b6257e7ed4e88c08f66
SSDEEP 49152:MfVftowgBKtexb0+FCzQHz1nL4lQsoFnt7b3h+:OBgBQexb0zzMlnsoFnh3h
MD5 SHA1 SHA512 SSDEEP

Submit Download

QUe3RU4z.f6

Path \Users\Admin\AppData\Local\Temp\7zSCCB81616\QUe3RU4z.f6
Size 2.3MB
SHA256 2e04be8a6b42f26774ab93c93f09d6e1dc4f39e7dfbcd941b87f8a8c35bcaf0d
MD5 83671c813cffa6dd9a8b2fafc5f9bd13
SHA1 5f27dc59cc5277068f2309fc2c759e8a1edf2942
SHA512 02a0a14a98a0ad567b816802937912f6e30eb3cac3e7b7ddce223f3815d4ea368a3403ca9d1fc7d250e5fe4a9fb0e6b698c25bd7fe009b6257e7ed4e88c08f66
SSDEEP 49152:MfVftowgBKtexb0+FCzQHz1nL4lQsoFnt7b3h+:OBgBQexb0zzMlnsoFnh3h
MD5 SHA1 SHA512 SSDEEP

Submit Download

QUe3RU4z.f6

Path \Users\Admin\AppData\Local\Temp\7zSCCB81616\QUe3RU4z.f6
Size 2.3MB
SHA256 2e04be8a6b42f26774ab93c93f09d6e1dc4f39e7dfbcd941b87f8a8c35bcaf0d
MD5 83671c813cffa6dd9a8b2fafc5f9bd13
SHA1 5f27dc59cc5277068f2309fc2c759e8a1edf2942
SHA512 02a0a14a98a0ad567b816802937912f6e30eb3cac3e7b7ddce223f3815d4ea368a3403ca9d1fc7d250e5fe4a9fb0e6b698c25bd7fe009b6257e7ed4e88c08f66
SSDEEP 49152:MfVftowgBKtexb0+FCzQHz1nL4lQsoFnt7b3h+:OBgBQexb0zzMlnsoFnh3h
MD5 SHA1 SHA512 SSDEEP

Submit Download

QUe3RU4z.f6

Path \Users\Admin\AppData\Local\Temp\7zSCCB81616\QUe3RU4z.f6
Size 2.3MB
SHA256 2e04be8a6b42f26774ab93c93f09d6e1dc4f39e7dfbcd941b87f8a8c35bcaf0d
MD5 83671c813cffa6dd9a8b2fafc5f9bd13
SHA1 5f27dc59cc5277068f2309fc2c759e8a1edf2942
SHA512 02a0a14a98a0ad567b816802937912f6e30eb3cac3e7b7ddce223f3815d4ea368a3403ca9d1fc7d250e5fe4a9fb0e6b698c25bd7fe009b6257e7ed4e88c08f66
SSDEEP 49152:MfVftowgBKtexb0+FCzQHz1nL4lQsoFnt7b3h+:OBgBQexb0zzMlnsoFnh3h
MD5 SHA1 SHA512 SSDEEP

Submit Download

QUe3RU4z.f6

Path \Users\Admin\AppData\Local\Temp\7zSCCB81616\QUe3RU4z.f6
Size 2.3MB
SHA256 2e04be8a6b42f26774ab93c93f09d6e1dc4f39e7dfbcd941b87f8a8c35bcaf0d
MD5 83671c813cffa6dd9a8b2fafc5f9bd13
SHA1 5f27dc59cc5277068f2309fc2c759e8a1edf2942
SHA512 02a0a14a98a0ad567b816802937912f6e30eb3cac3e7b7ddce223f3815d4ea368a3403ca9d1fc7d250e5fe4a9fb0e6b698c25bd7fe009b6257e7ed4e88c08f66
SSDEEP 49152:MfVftowgBKtexb0+FCzQHz1nL4lQsoFnt7b3h+:OBgBQexb0zzMlnsoFnh3h
MD5 SHA1 SHA512 SSDEEP

Submit Download

QUe3RU4z.f6

Path \Users\Admin\AppData\Local\Temp\7zSCCB81616\QUe3RU4z.f6
Size 2.3MB
SHA256 2e04be8a6b42f26774ab93c93f09d6e1dc4f39e7dfbcd941b87f8a8c35bcaf0d
MD5 83671c813cffa6dd9a8b2fafc5f9bd13
SHA1 5f27dc59cc5277068f2309fc2c759e8a1edf2942
SHA512 02a0a14a98a0ad567b816802937912f6e30eb3cac3e7b7ddce223f3815d4ea368a3403ca9d1fc7d250e5fe4a9fb0e6b698c25bd7fe009b6257e7ed4e88c08f66
SSDEEP 49152:MfVftowgBKtexb0+FCzQHz1nL4lQsoFnt7b3h+:OBgBQexb0zzMlnsoFnh3h
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2692-34-0x0000000002680000-0x00000000027A4000-memory.dmp

Download

memory/2692-35-0x00000000027B0000-0x00000000028B8000-memory.dmp

Download

memory/2692-38-0x00000000027B0000-0x00000000028B8000-memory.dmp

Download

memory/2692-39-0x00000000027B0000-0x00000000028B8000-memory.dmp

Download

memory/2964-21-0x0000000000B60000-0x0000000000C84000-memory.dmp

Download

memory/2964-23-0x0000000000D60000-0x0000000000E68000-memory.dmp

Download

memory/2964-26-0x0000000000D60000-0x0000000000E68000-memory.dmp

Download

memory/2964-27-0x0000000000D60000-0x0000000000E68000-memory.dmp

Download

memory/2964-22-0x0000000010000000-0x0000000010244000-memory.dmp

Download

memory/2964-17-0x00000000001A0000-0x00000000001A6000-memory.dmp

Download

memory/2964-16-0x0000000010000000-0x0000000010244000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads