35e6903f50ac0a868fcb2862ffc626a4f0571161ac1c01560dd0424a02044e07

Analysis

max time kernel
121s
max time network
141s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
28/10/2023, 19:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

35e6903f50ac0a868fcb2862ffc626a4f0571161ac1c01560dd0424a02044e07.exe
Size

816KB
MD5

776349986584ddfab084409ad9071d11
SHA1

0319e8f8522c8c1be53b8ec81e289a2a37fdda7a
SHA256

35e6903f50ac0a868fcb2862ffc626a4f0571161ac1c01560dd0424a02044e07
SHA512

f68f93ca85cbbff950339a07e325d1c47f174e3facd88e016b99d5c7e76aec215e0036d2a08eb4a90cadc2ff2dc17d6ee4f7d534714290706fe2d86d56bcd7c5
SSDEEP

24576:MY4G2qLMJalsnqShyoo77lUabuSvbDQOOdIxJsG9R:h3XZynV4oDabuWbDQOcIxJJ9R

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2300	1E0F0D0B120F156A155B15C0D0E160E0F160F.exe

Loads dropped DLL 2 IoCs

pid	Process
2512	35e6903f50ac0a868fcb2862ffc626a4f0571161ac1c01560dd0424a02044e07.exe
2512	35e6903f50ac0a868fcb2862ffc626a4f0571161ac1c01560dd0424a02044e07.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2512	35e6903f50ac0a868fcb2862ffc626a4f0571161ac1c01560dd0424a02044e07.exe
2300	1E0F0D0B120F156A155B15C0D0E160E0F160F.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2512 wrote to memory of 2300	2512	35e6903f50ac0a868fcb2862ffc626a4f0571161ac1c01560dd0424a02044e07.exe	28
PID 2512 wrote to memory of 2300	2512	35e6903f50ac0a868fcb2862ffc626a4f0571161ac1c01560dd0424a02044e07.exe	28
PID 2512 wrote to memory of 2300	2512	35e6903f50ac0a868fcb2862ffc626a4f0571161ac1c01560dd0424a02044e07.exe	28
PID 2512 wrote to memory of 2300	2512	35e6903f50ac0a868fcb2862ffc626a4f0571161ac1c01560dd0424a02044e07.exe	28

C:\Users\Admin\AppData\Local\Temp\35e6903f50ac0a868fcb2862ffc626a4f0571161ac1c01560dd0424a02044e07.exe
"C:\Users\Admin\AppData\Local\Temp\35e6903f50ac0a868fcb2862ffc626a4f0571161ac1c01560dd0424a02044e07.exe"
1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:2512
- C:\Users\Admin\AppData\Local\Temp\1E0F0D0B120F156A155B15C0D0E160E0F160F.exe
  C:\Users\Admin\AppData\Local\Temp\1E0F0D0B120F156A155B15C0D0E160E0F160F.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:2300

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\1E0F0D0B120F156A155B15C0D0E160E0F160F.exe

Filesize
816KB

MD5
5d9794f26bbeb92495dceeb9dfbbd264

SHA1
5f3dea52b160dccd1b6ceeb4740969b678468866

SHA256
25cf839ed98a7abde7d51e472b4ed61111d7ce0f7e7d4d156039a78cf05ef0b8

SHA512
034457532f157f7c43999d4ecccadef99383ffa3f049bc177ddc002b0e4b52c6c673223bcf5b397b3d181fd07815c28d3a2b47b2f432bc98014dfc412ab0c9a0

Download Submit
C:\Users\Admin\AppData\Local\Temp\1E0F0D0B120F156A155B15C0D0E160E0F160F.exe

Filesize
816KB

MD5
5d9794f26bbeb92495dceeb9dfbbd264

SHA1
5f3dea52b160dccd1b6ceeb4740969b678468866

SHA256
25cf839ed98a7abde7d51e472b4ed61111d7ce0f7e7d4d156039a78cf05ef0b8

SHA512
034457532f157f7c43999d4ecccadef99383ffa3f049bc177ddc002b0e4b52c6c673223bcf5b397b3d181fd07815c28d3a2b47b2f432bc98014dfc412ab0c9a0

Download Submit
\Users\Admin\AppData\Local\Temp\1E0F0D0B120F156A155B15C0D0E160E0F160F.exe

Filesize
816KB

MD5
5d9794f26bbeb92495dceeb9dfbbd264

SHA1
5f3dea52b160dccd1b6ceeb4740969b678468866

SHA256
25cf839ed98a7abde7d51e472b4ed61111d7ce0f7e7d4d156039a78cf05ef0b8

SHA512
034457532f157f7c43999d4ecccadef99383ffa3f049bc177ddc002b0e4b52c6c673223bcf5b397b3d181fd07815c28d3a2b47b2f432bc98014dfc412ab0c9a0

Download Submit
\Users\Admin\AppData\Local\Temp\1E0F0D0B120F156A155B15C0D0E160E0F160F.exe

Filesize
816KB

MD5
5d9794f26bbeb92495dceeb9dfbbd264

SHA1
5f3dea52b160dccd1b6ceeb4740969b678468866

SHA256
25cf839ed98a7abde7d51e472b4ed61111d7ce0f7e7d4d156039a78cf05ef0b8

SHA512
034457532f157f7c43999d4ecccadef99383ffa3f049bc177ddc002b0e4b52c6c673223bcf5b397b3d181fd07815c28d3a2b47b2f432bc98014dfc412ab0c9a0

Download Submit
memory/2300-13-0x0000000000400000-0x00000000005AD000-memory.dmp

Filesize
1.7MB

Download
memory/2300-15-0x0000000000400000-0x00000000005AD000-memory.dmp

Filesize
1.7MB

Download
memory/2300-16-0x0000000000400000-0x00000000005AD000-memory.dmp

Filesize
1.7MB

Download
memory/2512-0-0x0000000000400000-0x00000000005AD000-memory.dmp

Filesize
1.7MB

Download
memory/2512-2-0x0000000000400000-0x00000000005AD000-memory.dmp

Filesize
1.7MB

Download
memory/2512-12-0x0000000000400000-0x00000000005AD000-memory.dmp

Filesize
1.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads