b6c7f66593503ce7de53dec372a3407ab0c0ed221007eac96e44dd9b9488df0d

Analysis

max time kernel
141s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
30/09/2023, 18:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SecuriteInfo.com.Gen.Variant.Mikey.154275.20256.24835.exe
Size 2.2MB
Sample230930-w92dpsgb97
SHA256 b6c7f66593503ce7de53dec372a3407ab0c0ed221007eac96e44dd9b9488df0d
MD5 b7db7a02a8590f38ba28dd5d4a75bd7b
SHA1 2f244bc5c19b10be3b35f6ebba3b75d12edadcbc
SHA512 7a5a595a8f827bef7172974d321c50ca579314b58d6692862a3747fdb9eda101d103d0891a0849995762f5cad86fead5231dad731ea36592d9b24ac540c50eaa
SSDEEP 49152:WfAm2sLxHoyUTWgvedeVU8yTtCKE6lW0Ez0q3MFS/sktK:WLnHaeQUNRCYlbgC
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
2052	rundll32.exe
1624	rundll32.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1464 wrote to memory of 2516	1464	SecuriteInfo.com.Gen.Variant.Mikey.154275.20256.24835.exe	85
PID 1464 wrote to memory of 2516	1464	SecuriteInfo.com.Gen.Variant.Mikey.154275.20256.24835.exe	85
PID 1464 wrote to memory of 2516	1464	SecuriteInfo.com.Gen.Variant.Mikey.154275.20256.24835.exe	85
PID 2516 wrote to memory of 656	2516	cmd.exe	87
PID 2516 wrote to memory of 656	2516	cmd.exe	87
PID 2516 wrote to memory of 656	2516	cmd.exe	87
PID 656 wrote to memory of 2052	656	control.exe	89
PID 656 wrote to memory of 2052	656	control.exe	89
PID 656 wrote to memory of 2052	656	control.exe	89
PID 2052 wrote to memory of 4456	2052	rundll32.exe	94
PID 2052 wrote to memory of 4456	2052	rundll32.exe	94
PID 4456 wrote to memory of 1624	4456	RunDll32.exe	95
PID 4456 wrote to memory of 1624	4456	RunDll32.exe	95
PID 4456 wrote to memory of 1624	4456	RunDll32.exe	95

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Gen.Variant.Mikey.154275.20256.24835.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Gen.Variant.Mikey.154275.20256.24835.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1464
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c .\xO77CPZ.bAT
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2516
- - C:\Windows\SysWOW64\control.exe
    COntROL "C:\Users\Admin\AppData\Local\Temp\7zS8B561DB7\QUe3RU4z.f6"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:656
  - - C:\Windows\SysWOW64\rundll32.exe
      "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\7zS8B561DB7\QUe3RU4z.f6"
      4⤵
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:2052
    - - C:\Windows\system32\RunDll32.exe
        
        C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\7zS8B561DB7\QUe3RU4z.f6"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4456
      - C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 "C:\Users\Admin\AppData\Local\Temp\7zS8B561DB7\QUe3RU4z.f6"
        6⤵
        Loads dropped DLL
        
        PID:1624

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

QUe3RU4z.f6

Path C:\Users\Admin\AppData\Local\Temp\7zS8B561DB7\QUe3RU4z.f6
Size 2.3MB
SHA256 2e04be8a6b42f26774ab93c93f09d6e1dc4f39e7dfbcd941b87f8a8c35bcaf0d
MD5 83671c813cffa6dd9a8b2fafc5f9bd13
SHA1 5f27dc59cc5277068f2309fc2c759e8a1edf2942
SHA512 02a0a14a98a0ad567b816802937912f6e30eb3cac3e7b7ddce223f3815d4ea368a3403ca9d1fc7d250e5fe4a9fb0e6b698c25bd7fe009b6257e7ed4e88c08f66
SSDEEP 49152:MfVftowgBKtexb0+FCzQHz1nL4lQsoFnt7b3h+:OBgBQexb0zzMlnsoFnh3h
MD5 SHA1 SHA512 SSDEEP

Submit Download

QUe3RU4z.f6

Path C:\Users\Admin\AppData\Local\Temp\7zS8B561DB7\QUe3RU4z.f6
Size 2.3MB
SHA256 2e04be8a6b42f26774ab93c93f09d6e1dc4f39e7dfbcd941b87f8a8c35bcaf0d
MD5 83671c813cffa6dd9a8b2fafc5f9bd13
SHA1 5f27dc59cc5277068f2309fc2c759e8a1edf2942
SHA512 02a0a14a98a0ad567b816802937912f6e30eb3cac3e7b7ddce223f3815d4ea368a3403ca9d1fc7d250e5fe4a9fb0e6b698c25bd7fe009b6257e7ed4e88c08f66
SSDEEP 49152:MfVftowgBKtexb0+FCzQHz1nL4lQsoFnt7b3h+:OBgBQexb0zzMlnsoFnh3h
MD5 SHA1 SHA512 SSDEEP

Submit Download

QUe3RU4z.f6

Path C:\Users\Admin\AppData\Local\Temp\7zS8B561DB7\QUe3RU4z.f6
Size 2.3MB
SHA256 2e04be8a6b42f26774ab93c93f09d6e1dc4f39e7dfbcd941b87f8a8c35bcaf0d
MD5 83671c813cffa6dd9a8b2fafc5f9bd13
SHA1 5f27dc59cc5277068f2309fc2c759e8a1edf2942
SHA512 02a0a14a98a0ad567b816802937912f6e30eb3cac3e7b7ddce223f3815d4ea368a3403ca9d1fc7d250e5fe4a9fb0e6b698c25bd7fe009b6257e7ed4e88c08f66
SSDEEP 49152:MfVftowgBKtexb0+FCzQHz1nL4lQsoFnt7b3h+:OBgBQexb0zzMlnsoFnh3h
MD5 SHA1 SHA512 SSDEEP

Submit Download

xO77CpZ.bat

Path C:\Users\Admin\AppData\Local\Temp\7zS8B561DB7\xO77CpZ.bat
Size 29B
SHA256 0a51a4776ebbcb84535d45031519af3d1da64f1e64127aeb286dbf942530bb11
MD5 b7d2b0c4a2668b61a5bd59c67de7c5f3
SHA1 d8f0d75dc9ad21b1719983b476675bcf85053c7c
SHA512 387aeac127c69c7651358ba1c11ced05292ef0815cf33f9a6c8fc88c100330d286a51ed7a7f1d74713bfc1a78837c8548ad0bd93d916a7eb780cb88cf242f655
MD5 SHA1 SHA512

Submit Download

memory/1624-26-0x0000000003540000-0x0000000003648000-memory.dmp

Download

memory/1624-25-0x0000000003540000-0x0000000003648000-memory.dmp

Download

memory/1624-22-0x0000000003540000-0x0000000003648000-memory.dmp

Download

memory/1624-21-0x0000000003410000-0x0000000003534000-memory.dmp

Download

memory/1624-18-0x0000000002BA0000-0x0000000002BA6000-memory.dmp

Download

memory/2052-9-0x0000000010000000-0x0000000010244000-memory.dmp

Download

memory/2052-16-0x0000000003210000-0x0000000003318000-memory.dmp

Download

memory/2052-15-0x0000000003210000-0x0000000003318000-memory.dmp

Download

memory/2052-12-0x0000000003210000-0x0000000003318000-memory.dmp

Download

memory/2052-11-0x00000000030E0000-0x0000000003204000-memory.dmp

Download

memory/2052-8-0x0000000002C80000-0x0000000002C86000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads