Analysis
-
max time kernel
120s -
max time network
129s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
13/10/2023, 04:18
Behavioral task
behavioral1
Sample
Auto Coin Transfer.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
Auto Coin Transfer.exe
Resource
win10v2004-20230915-en
General
-
Target
Auto Coin Transfer.exe
-
Size
97.4MB
-
MD5
358b7b4e45223fd87f08b4c0c72f4c16
-
SHA1
ea50baf7a6e9b9f9e4ea1649319e3777ced8ad43
-
SHA256
f7117a624cf47295c3714b57a76075eeb4a14cc641b4f86cd04a5364b92491d1
-
SHA512
61b051e83ee06406d80783082186b848246dc96b9510bde1ea03845aabd402e6439593e1ffe4bff3ac3621e3e297668dec0d44bbede945365a9724ca80f5fbfa
-
SSDEEP
3145728:jxgYRPSC++6yopMkkQkTyCAS/DO+nCdqGkF02IlNRmj0:jxxaC4yopMk/keAK+CjkF02Ilaw
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 2696 Auto Coin Transfer.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2352 wrote to memory of 2696 2352 Auto Coin Transfer.exe 30 PID 2352 wrote to memory of 2696 2352 Auto Coin Transfer.exe 30 PID 2352 wrote to memory of 2696 2352 Auto Coin Transfer.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\Auto Coin Transfer.exe"C:\Users\Admin\AppData\Local\Temp\Auto Coin Transfer.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2352 -
C:\Users\Admin\AppData\Local\Temp\Auto Coin Transfer.exe"C:\Users\Admin\AppData\Local\Temp\Auto Coin Transfer.exe"2⤵
- Loads dropped DLL
PID:2696
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.5MB
MD5e2bd5ae53427f193b42d64b8e9bf1943
SHA17c317aad8e2b24c08d3b8b3fba16dd537411727f
SHA256c4844b05e3a936b130adedb854d3c04d49ee54edb43e9d36f8c4ae94ccb78400
SHA512ae23a6707e539c619fd5c5b4fc6e4734edc91f89ebe024d25ff2a70168da6105ac0bd47cf6bf3715af6411963caf0acbb4632464e1619ca6361abf53adfe7036
-
Filesize
5.5MB
MD5e2bd5ae53427f193b42d64b8e9bf1943
SHA17c317aad8e2b24c08d3b8b3fba16dd537411727f
SHA256c4844b05e3a936b130adedb854d3c04d49ee54edb43e9d36f8c4ae94ccb78400
SHA512ae23a6707e539c619fd5c5b4fc6e4734edc91f89ebe024d25ff2a70168da6105ac0bd47cf6bf3715af6411963caf0acbb4632464e1619ca6361abf53adfe7036