a18d70e3153b96610d4b5184174ae154aabd4312eb91ff1e9d321c815b01a536

Analysis

max time kernel
118s
max time network
123s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
12/10/2023, 05:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a18d70e3153b96610d4b5184174ae154aabd4312eb91ff1e9d321c815b01a536.exe
Size

812KB
MD5

7edf6026ee96211c8522a4f65243a67f
SHA1

7f807f41b4b8adfc40a70bc6730ae1ea04279269
SHA256

a18d70e3153b96610d4b5184174ae154aabd4312eb91ff1e9d321c815b01a536
SHA512

2c90d2bc0329f4c55bc88be0997a0b6d54dfde183c0f765d42939cfac83ca6d03f820312a229b9b06d28462705877fad1c83881cc3ef21049ca20c4a4801954f
SSDEEP

12288:eqmytVdB0rPEDb3kCoI641jxy7GHEX2rnAv8MktrOKxp22CMOZ/1Sq:eqxtVfNDb31oT41+aneOrO4p2zMOZ/V

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2696	1E0B0F0F120B156C155A15C0F0E160B0E160B.exe

Loads dropped DLL 2 IoCs

pid	Process
1728	a18d70e3153b96610d4b5184174ae154aabd4312eb91ff1e9d321c815b01a536.exe
1728	a18d70e3153b96610d4b5184174ae154aabd4312eb91ff1e9d321c815b01a536.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
1728	a18d70e3153b96610d4b5184174ae154aabd4312eb91ff1e9d321c815b01a536.exe
2696	1E0B0F0F120B156C155A15C0F0E160B0E160B.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1728 wrote to memory of 2696	1728	a18d70e3153b96610d4b5184174ae154aabd4312eb91ff1e9d321c815b01a536.exe	28
PID 1728 wrote to memory of 2696	1728	a18d70e3153b96610d4b5184174ae154aabd4312eb91ff1e9d321c815b01a536.exe	28
PID 1728 wrote to memory of 2696	1728	a18d70e3153b96610d4b5184174ae154aabd4312eb91ff1e9d321c815b01a536.exe	28
PID 1728 wrote to memory of 2696	1728	a18d70e3153b96610d4b5184174ae154aabd4312eb91ff1e9d321c815b01a536.exe	28

C:\Users\Admin\AppData\Local\Temp\a18d70e3153b96610d4b5184174ae154aabd4312eb91ff1e9d321c815b01a536.exe
"C:\Users\Admin\AppData\Local\Temp\a18d70e3153b96610d4b5184174ae154aabd4312eb91ff1e9d321c815b01a536.exe"
1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:1728
- C:\Users\Admin\AppData\Local\Temp\1E0B0F0F120B156C155A15C0F0E160B0E160B.exe
  C:\Users\Admin\AppData\Local\Temp\1E0B0F0F120B156C155A15C0F0E160B0E160B.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:2696

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\1E0B0F0F120B156C155A15C0F0E160B0E160B.exe

Filesize
812KB

MD5
785ee6a60c1f2dd1181cfcc012d3b8ae

SHA1
1f884ef9687e76a3ffb17350bf6d5e3e87cfa98a

SHA256
3d4ba3830a0be55710b6ed8b84cf169b32de27c5438f7f184900eb9d0b1286eb

SHA512
ff0731d498277ef8ab84c9440fce47ebb6e0c83e58b9d88f71fccaba9d594cc149386ed38a0892166ebaf97ab9536c6aa54c48608b6f8ca0d7c7e72856f2a0d7

Download Submit
C:\Users\Admin\AppData\Local\Temp\1E0B0F0F120B156C155A15C0F0E160B0E160B.exe

Filesize
812KB

MD5
785ee6a60c1f2dd1181cfcc012d3b8ae

SHA1
1f884ef9687e76a3ffb17350bf6d5e3e87cfa98a

SHA256
3d4ba3830a0be55710b6ed8b84cf169b32de27c5438f7f184900eb9d0b1286eb

SHA512
ff0731d498277ef8ab84c9440fce47ebb6e0c83e58b9d88f71fccaba9d594cc149386ed38a0892166ebaf97ab9536c6aa54c48608b6f8ca0d7c7e72856f2a0d7

Download Submit
\Users\Admin\AppData\Local\Temp\1E0B0F0F120B156C155A15C0F0E160B0E160B.exe

Filesize
812KB

MD5
785ee6a60c1f2dd1181cfcc012d3b8ae

SHA1
1f884ef9687e76a3ffb17350bf6d5e3e87cfa98a

SHA256
3d4ba3830a0be55710b6ed8b84cf169b32de27c5438f7f184900eb9d0b1286eb

SHA512
ff0731d498277ef8ab84c9440fce47ebb6e0c83e58b9d88f71fccaba9d594cc149386ed38a0892166ebaf97ab9536c6aa54c48608b6f8ca0d7c7e72856f2a0d7

Download Submit
\Users\Admin\AppData\Local\Temp\1E0B0F0F120B156C155A15C0F0E160B0E160B.exe

Filesize
812KB

MD5
785ee6a60c1f2dd1181cfcc012d3b8ae

SHA1
1f884ef9687e76a3ffb17350bf6d5e3e87cfa98a

SHA256
3d4ba3830a0be55710b6ed8b84cf169b32de27c5438f7f184900eb9d0b1286eb

SHA512
ff0731d498277ef8ab84c9440fce47ebb6e0c83e58b9d88f71fccaba9d594cc149386ed38a0892166ebaf97ab9536c6aa54c48608b6f8ca0d7c7e72856f2a0d7

Download Submit
memory/1728-0-0x0000000000400000-0x00000000005AB000-memory.dmp

Filesize
1.7MB

Download
memory/1728-1-0x0000000000400000-0x00000000005AB000-memory.dmp

Filesize
1.7MB

Download
memory/1728-4-0x0000000000400000-0x00000000005AB000-memory.dmp

Filesize
1.7MB

Download
memory/1728-12-0x0000000000400000-0x00000000005AB000-memory.dmp

Filesize
1.7MB

Download
memory/2696-13-0x0000000000400000-0x00000000005AB000-memory.dmp

Filesize
1.7MB

Download
memory/2696-15-0x0000000000400000-0x00000000005AB000-memory.dmp

Filesize
1.7MB

Download
memory/2696-16-0x0000000000400000-0x00000000005AB000-memory.dmp

Filesize
1.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads