1d33d754927b5aa9071de61ef7e475c779eacab54f92cca294d2d89f33bedd1a

Analysis

max time kernel
144s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
16/10/2023, 06:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
f776f7164123bf4faec3943f3c13f702.exe
Size 2.0MB
Sample231016-he7qcaec58
SHA256 1d33d754927b5aa9071de61ef7e475c779eacab54f92cca294d2d89f33bedd1a
MD5 f776f7164123bf4faec3943f3c13f702
SHA1 3e41e8b7c1932d13c502409b9bba905d15737ea0
SHA512 1178c7d324744963eefeca7c84687a1711fb53f48c55f72ae533d0bb99defd8ab39c21509b383695f24329fd16d05cc0bfe46825d374a1f94190d66726386b85
SSDEEP 49152:B8vLBRAlyuAZgiDomIuo3eiH5g8Edg5JfoA+wWM3+iHBy:B8vLayuAZgEoIgeiiYoFxQHBy
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
3244	rundll32.exe
2480	rundll32.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 4156 wrote to memory of 4484	4156	f776f7164123bf4faec3943f3c13f702.exe	67
PID 4156 wrote to memory of 4484	4156	f776f7164123bf4faec3943f3c13f702.exe	67
PID 4156 wrote to memory of 4484	4156	f776f7164123bf4faec3943f3c13f702.exe	67
PID 4484 wrote to memory of 2956	4484	cmd.exe	84
PID 4484 wrote to memory of 2956	4484	cmd.exe	84
PID 4484 wrote to memory of 2956	4484	cmd.exe	84
PID 2956 wrote to memory of 3244	2956	control.exe	85
PID 2956 wrote to memory of 3244	2956	control.exe	85
PID 2956 wrote to memory of 3244	2956	control.exe	85
PID 3244 wrote to memory of 4680	3244	rundll32.exe	91
PID 3244 wrote to memory of 4680	3244	rundll32.exe	91
PID 4680 wrote to memory of 2480	4680	RunDll32.exe	92
PID 4680 wrote to memory of 2480	4680	RunDll32.exe	92
PID 4680 wrote to memory of 2480	4680	RunDll32.exe	92

C:\Users\Admin\AppData\Local\Temp\f776f7164123bf4faec3943f3c13f702.exe
"C:\Users\Admin\AppData\Local\Temp\f776f7164123bf4faec3943f3c13f702.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4156
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c .\eOZ.bAt
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4484
- - C:\Windows\SysWOW64\control.exe
    CONTrol "C:\Users\Admin\AppData\Local\Temp\7zSC304DBD7\uXH5.X"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2956
  - - C:\Windows\SysWOW64\rundll32.exe
      "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\7zSC304DBD7\uXH5.X"
      4⤵
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:3244
    - - C:\Windows\system32\RunDll32.exe
        
        C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\7zSC304DBD7\uXH5.X"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4680
      - C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 "C:\Users\Admin\AppData\Local\Temp\7zSC304DBD7\uXH5.X"
        6⤵
        Loads dropped DLL
        
        PID:2480

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

eOZ.bat

Path C:\Users\Admin\AppData\Local\Temp\7zSC304DBD7\eOZ.bat
Size 27B
SHA256 3ccdf777b46ae67985a9576a888e73cfa9f662555148cbed8e98e7ca17e30486
MD5 01d970d31983151181d0ce12cbeacbd8
SHA1 b991a998b9636ca9153566d20a6c27f2aa51d347
SHA512 b1a26d92ab20ef5938e5947f3a9b4163ea5ed1ad31d91cbbed44c511c0c43bc5d0c321704ffb7b7b2445f7665893d2768278eea28078810b7091fa3a07746f0e
MD5 SHA1 SHA512

Submit Download

uXH5.X

Path C:\Users\Admin\AppData\Local\Temp\7zSC304DBD7\uXH5.X
Size 1.9MB
SHA256 4674ecd3569c6bb47e49d1fc9dec1dcb20e10ee34bc1800e1f41b230cebda4e0
MD5 1329218ad8de6e1905718f3aa9e96ad7
SHA1 51b38ecad5c53f44a4d2c87f1c828d41c0400959
SHA512 89b9207ac687e2690b741598cc61ff86ff5c3f0a63bfa76bd6815e270b276cf7810a5d72d8f29747c28d443abde5c73200ad737b1f921856a3cd472eb49d4362
SSDEEP 49152:qLZVCjTIW3qs0ABG+pIJg9psar+yzPIsp:kVCjMCqRSHpz93bPIs
MD5 SHA1 SHA512 SSDEEP

Submit Download

uXH5.X

Path C:\Users\Admin\AppData\Local\Temp\7zSC304DBD7\uXH5.X
Size 1.9MB
SHA256 4674ecd3569c6bb47e49d1fc9dec1dcb20e10ee34bc1800e1f41b230cebda4e0
MD5 1329218ad8de6e1905718f3aa9e96ad7
SHA1 51b38ecad5c53f44a4d2c87f1c828d41c0400959
SHA512 89b9207ac687e2690b741598cc61ff86ff5c3f0a63bfa76bd6815e270b276cf7810a5d72d8f29747c28d443abde5c73200ad737b1f921856a3cd472eb49d4362
SSDEEP 49152:qLZVCjTIW3qs0ABG+pIJg9psar+yzPIsp:kVCjMCqRSHpz93bPIs
MD5 SHA1 SHA512 SSDEEP

Submit Download

uXH5.X

Path C:\Users\Admin\AppData\Local\Temp\7zSC304DBD7\uXH5.X
Size 1.9MB
SHA256 4674ecd3569c6bb47e49d1fc9dec1dcb20e10ee34bc1800e1f41b230cebda4e0
MD5 1329218ad8de6e1905718f3aa9e96ad7
SHA1 51b38ecad5c53f44a4d2c87f1c828d41c0400959
SHA512 89b9207ac687e2690b741598cc61ff86ff5c3f0a63bfa76bd6815e270b276cf7810a5d72d8f29747c28d443abde5c73200ad737b1f921856a3cd472eb49d4362
SSDEEP 49152:qLZVCjTIW3qs0ABG+pIJg9psar+yzPIsp:kVCjMCqRSHpz93bPIs
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2480-27-0x0000000003160000-0x0000000003254000-memory.dmp

Download

memory/2480-26-0x0000000003160000-0x0000000003254000-memory.dmp

Download

memory/2480-22-0x0000000003160000-0x0000000003254000-memory.dmp

Download

memory/2480-21-0x0000000003050000-0x000000000315D000-memory.dmp

Download

memory/2480-18-0x0000000001050000-0x0000000001056000-memory.dmp

Download

memory/3244-9-0x0000000010000000-0x00000000101E4000-memory.dmp

Download

memory/3244-16-0x0000000002FD0000-0x00000000030C4000-memory.dmp

Download

memory/3244-15-0x0000000002FD0000-0x00000000030C4000-memory.dmp

Download

memory/3244-12-0x0000000002FD0000-0x00000000030C4000-memory.dmp

Download

memory/3244-23-0x00000000027D0000-0x00000000027D6000-memory.dmp

Download

memory/3244-11-0x0000000002EB0000-0x0000000002FBD000-memory.dmp

Download

memory/3244-8-0x00000000027D0000-0x00000000027D6000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads