3c37069adb01608944a230bd4d628730c4285e3b2fc33bedef77cba4fe32504a

Analysis

max time kernel
24s
max time network
63s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
13/10/2023, 19:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

3c37069adb01608944a230bd4d628730c4285e3b2fc33bedef77cba4fe32504a.exe
Size

11.7MB
MD5

56371efb275a519cfb49e9ff4dd7ef70
SHA1

424077a28d8e3640eded57efcce823345dcf8cf1
SHA256

3c37069adb01608944a230bd4d628730c4285e3b2fc33bedef77cba4fe32504a
SHA512

9bfaacccbf38db77f8ea7f21a0b1e6108cb57da1afee71140cfb5b66179fe83e3410de356ddcae6deda5b575323310c879da4c42ced3e23afb045446a4ea0dc4
SSDEEP

196608:ui8HH/H+ZEmHJb0y+r/wre/abSq4oVmhSzkikLWHXW28V785qMlijw85G9:58nwfHJwsXSqpVmhp63Wx78kIMw8

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
2960	3c37069adb01608944a230bd4d628730c4285e3b2fc33bedef77cba4fe32504a.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\HPSocket4C.dll	3c37069adb01608944a230bd4d628730c4285e3b2fc33bedef77cba4fe32504a.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
2960	3c37069adb01608944a230bd4d628730c4285e3b2fc33bedef77cba4fe32504a.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2960	3c37069adb01608944a230bd4d628730c4285e3b2fc33bedef77cba4fe32504a.exe
2960	3c37069adb01608944a230bd4d628730c4285e3b2fc33bedef77cba4fe32504a.exe
2960	3c37069adb01608944a230bd4d628730c4285e3b2fc33bedef77cba4fe32504a.exe
2960	3c37069adb01608944a230bd4d628730c4285e3b2fc33bedef77cba4fe32504a.exe
2960	3c37069adb01608944a230bd4d628730c4285e3b2fc33bedef77cba4fe32504a.exe
2960	3c37069adb01608944a230bd4d628730c4285e3b2fc33bedef77cba4fe32504a.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2960	3c37069adb01608944a230bd4d628730c4285e3b2fc33bedef77cba4fe32504a.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2960	3c37069adb01608944a230bd4d628730c4285e3b2fc33bedef77cba4fe32504a.exe
2960	3c37069adb01608944a230bd4d628730c4285e3b2fc33bedef77cba4fe32504a.exe

C:\Users\Admin\AppData\Local\Temp\3c37069adb01608944a230bd4d628730c4285e3b2fc33bedef77cba4fe32504a.exe
"C:\Users\Admin\AppData\Local\Temp\3c37069adb01608944a230bd4d628730c4285e3b2fc33bedef77cba4fe32504a.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
PID:2960

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\3c37069adb01608944a230bd4d628730c4285e3b2fc33bedef77cba4fe32504a.exe

Filesize
11.7MB

MD5
56371efb275a519cfb49e9ff4dd7ef70

SHA1
424077a28d8e3640eded57efcce823345dcf8cf1

SHA256
3c37069adb01608944a230bd4d628730c4285e3b2fc33bedef77cba4fe32504a

SHA512
9bfaacccbf38db77f8ea7f21a0b1e6108cb57da1afee71140cfb5b66179fe83e3410de356ddcae6deda5b575323310c879da4c42ced3e23afb045446a4ea0dc4

Download Submit
\Windows\SysWOW64\HPSocket4C.dll

Filesize
1.7MB

MD5
707aa56cf742eb934185edf0a69d7289

SHA1
dab68976c4bd2d420c8adcd268fc1ffdd5e277e0

SHA256
3582d7ad93c54c2efddac6df4cf7d9e4b2ef1d8895dc9d12a781faf3cfb8bf12

SHA512
8be50ffedd0a250b4519069cec5781a9d0182fe47dce79c1991fc775a9580550c4b512de37e3423dc5d22013dce4cdcb1f178becbf5ef8ccb610c7ccd6d0f54d

Download Submit
memory/2960-19-0x00000000003E0000-0x00000000003E1000-memory.dmp

Filesize
4KB

Download
memory/2960-22-0x00000000003F0000-0x00000000003F1000-memory.dmp

Filesize
4KB

Download
memory/2960-4-0x00000000003C0000-0x00000000003C1000-memory.dmp

Filesize
4KB

Download
memory/2960-6-0x00000000003C0000-0x00000000003C1000-memory.dmp

Filesize
4KB

Download
memory/2960-8-0x0000000000400000-0x0000000001BC0000-memory.dmp

Filesize
23.8MB

Download
memory/2960-9-0x00000000003C0000-0x00000000003C1000-memory.dmp

Filesize
4KB

Download
memory/2960-10-0x00000000003D0000-0x00000000003D1000-memory.dmp

Filesize
4KB

Download
memory/2960-12-0x00000000003D0000-0x00000000003D1000-memory.dmp

Filesize
4KB

Download
memory/2960-14-0x00000000003D0000-0x00000000003D1000-memory.dmp

Filesize
4KB

Download
memory/2960-34-0x0000000001D60000-0x0000000001D61000-memory.dmp

Filesize
4KB

Download
memory/2960-3-0x00000000020E0000-0x0000000002287000-memory.dmp

Filesize
1.7MB

Download
memory/2960-0-0x00000000020E0000-0x0000000002287000-memory.dmp

Filesize
1.7MB

Download
memory/2960-17-0x00000000003E0000-0x00000000003E1000-memory.dmp

Filesize
4KB

Download
memory/2960-32-0x0000000001D60000-0x0000000001D61000-memory.dmp

Filesize
4KB

Download
memory/2960-29-0x0000000001D50000-0x0000000001D51000-memory.dmp

Filesize
4KB

Download
memory/2960-27-0x0000000001D50000-0x0000000001D51000-memory.dmp

Filesize
4KB

Download
memory/2960-24-0x00000000003F0000-0x00000000003F1000-memory.dmp

Filesize
4KB

Download
memory/2960-2-0x0000000000400000-0x0000000001BC0000-memory.dmp

Filesize
23.8MB

Download
memory/2960-45-0x0000000000400000-0x0000000001BC0000-memory.dmp

Filesize
23.8MB

Download
memory/2960-1-0x00000000020E0000-0x0000000002287000-memory.dmp

Filesize
1.7MB

Download
memory/2960-48-0x0000000000400000-0x0000000001BC0000-memory.dmp

Filesize
23.8MB

Download
memory/2960-49-0x0000000000400000-0x0000000001BC0000-memory.dmp

Filesize
23.8MB

Download