1d0128fd3184a765076397dd308e51bbc578a3639cb9c08ab6b5c36704d772b4

Resubmissions

14/11/2023, 17:31

231114-v3qg7acf42 10

14/11/2023, 17:21

28/10/2023, 19:29

24/10/2023, 13:29

18/10/2023, 12:04

07/09/2023, 12:10

Analysis

max time kernel
442s
max time network
448s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
24/10/2023, 13:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ded033da36fbf8287d0df6f21a0339b6e1046ce678b46e7cd558f63e22df1158.exe
Size

278KB
MD5

6621340d04e507aaa1595cc078de9d74
SHA1

ea59335ea2c7504eeb1227cb741fee0d1ba1caf1
SHA256

ded033da36fbf8287d0df6f21a0339b6e1046ce678b46e7cd558f63e22df1158
SHA512

a9cb0f631e56e7350713e1c1c70fb62c2c5c40e89b2d74c3fb5e496cddef59497aae2bd8a4dbe0d8259cde7dadefd555c705b1b788f1d866b0d957966a95e6e3
SSDEEP

6144:QhNy9Dw3FKqOiUjkMbQ5DWku3s2A9/voANg6tOmEhko3laTv0vQ:8sJjkuQ5Yo9/vLyuOxkyaLl

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4476	svhest.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\svhest.exe	ded033da36fbf8287d0df6f21a0339b6e1046ce678b46e7cd558f63e22df1158.exe
File opened for modification	C:\Windows\SysWOW64\svhest.exe	ded033da36fbf8287d0df6f21a0339b6e1046ce678b46e7cd558f63e22df1158.exe
File opened for modification	C:\Windows\SysWOW64\svhest.exe	svhest.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\RAV2007.BAT	ded033da36fbf8287d0df6f21a0339b6e1046ce678b46e7cd558f63e22df1158.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5024 wrote to memory of 4964	5024	ded033da36fbf8287d0df6f21a0339b6e1046ce678b46e7cd558f63e22df1158.exe	89
PID 5024 wrote to memory of 4964	5024	ded033da36fbf8287d0df6f21a0339b6e1046ce678b46e7cd558f63e22df1158.exe	89
PID 5024 wrote to memory of 4964	5024	ded033da36fbf8287d0df6f21a0339b6e1046ce678b46e7cd558f63e22df1158.exe	89

C:\Users\Admin\AppData\Local\Temp\ded033da36fbf8287d0df6f21a0339b6e1046ce678b46e7cd558f63e22df1158.exe
"C:\Users\Admin\AppData\Local\Temp\ded033da36fbf8287d0df6f21a0339b6e1046ce678b46e7cd558f63e22df1158.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:5024
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\RAV2007.BAT
  2⤵
  PID:4964

C:\Windows\SysWOW64\svhest.exe
C:\Windows\SysWOW64\svhest.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4476

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\RAV2007.BAT

Filesize
254B

MD5
e1ece2cb5162991f88824995b1e7e5e4

SHA1
95e0fb280d7b6a4f70eeb0b9f12bb9e79a344b61

SHA256
bcd2fb9574dcfe63e5eca517a2e72cbdf3246ee6766d6f46f7e5fb38d0c86222

SHA512
896f09727b683baff1a9212ad7ca70d82f22742c86c7cb3658464eddc8477c7e57ac001a3a8ffafcabdc5f1a4a5715fcc149fad399ba58a3ff54e8bb51d9672e

Download Submit
C:\Windows\SysWOW64\svhest.exe

Filesize
278KB

MD5
6621340d04e507aaa1595cc078de9d74

SHA1
ea59335ea2c7504eeb1227cb741fee0d1ba1caf1

SHA256
ded033da36fbf8287d0df6f21a0339b6e1046ce678b46e7cd558f63e22df1158

SHA512
a9cb0f631e56e7350713e1c1c70fb62c2c5c40e89b2d74c3fb5e496cddef59497aae2bd8a4dbe0d8259cde7dadefd555c705b1b788f1d866b0d957966a95e6e3

Download Submit
C:\Windows\SysWOW64\svhest.exe

Filesize
278KB

MD5
6621340d04e507aaa1595cc078de9d74

SHA1
ea59335ea2c7504eeb1227cb741fee0d1ba1caf1

SHA256
ded033da36fbf8287d0df6f21a0339b6e1046ce678b46e7cd558f63e22df1158

SHA512
a9cb0f631e56e7350713e1c1c70fb62c2c5c40e89b2d74c3fb5e496cddef59497aae2bd8a4dbe0d8259cde7dadefd555c705b1b788f1d866b0d957966a95e6e3

Download Submit
memory/4476-6-0x0000000000400000-0x0000000000535000-memory.dmp

Filesize
1.2MB

Download
memory/4476-7-0x0000000000400000-0x0000000000535000-memory.dmp

Filesize
1.2MB

Download
memory/5024-0-0x0000000000400000-0x0000000000535000-memory.dmp

Filesize
1.2MB

Download
memory/5024-1-0x0000000002280000-0x0000000002281000-memory.dmp

Filesize
4KB

Download
memory/5024-2-0x0000000000400000-0x0000000000535000-memory.dmp

Filesize
1.2MB

Download
memory/5024-10-0x0000000000400000-0x0000000000535000-memory.dmp

Filesize
1.2MB

Download