Overview

overview

7

Static

static

3

d1b2ca5827...db.exe

windows7-x64

7

d1b2ca5827...db.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    142s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231023-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01-11-2023 22:09

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    d1b2ca5827639be1bfe75a9828a01647d7746efc22f7b6abe7a2336463c52cdb.exe

  • Size

    816KB

  • MD5

    2164a16ac450069e3e829d7604db1384

  • SHA1

    98df5b370ce4d5f6e7e0c27ddd84de2d8eb027dd

  • SHA256

    d1b2ca5827639be1bfe75a9828a01647d7746efc22f7b6abe7a2336463c52cdb

  • SHA512

    c317737cf8f81c053ffefe1f357c52f967d15ce272dec64a97397c219d0b26702ad49cc6ea55b35598890872001f100140889bc1e09bcad0a3f21643b5889616

  • SSDEEP

    24576:HY4G2qLMJalsnqShyoo77lUabuSvbDQOOdIxJsG90:43XZynV4oDabuWbDQOcIxJJ90

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d1b2ca5827639be1bfe75a9828a01647d7746efc22f7b6abe7a2336463c52cdb.exe
    "C:\Users\Admin\AppData\Local\Temp\d1b2ca5827639be1bfe75a9828a01647d7746efc22f7b6abe7a2336463c52cdb.exe"
    1⤵
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious use of WriteProcessMemory
    PID:4964
    • C:\Users\Admin\AppData\Local\Temp\1A0E0C0A120B156E155C15A0A0E160B0A160D.exe
      C:\Users\Admin\AppData\Local\Temp\1A0E0C0A120B156E155C15A0A0E160B0A160D.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      PID:2208

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\1A0E0C0A120B156E155C15A0A0E160B0A160D.exe
    Filesize

    816KB

    MD5

    892065b2b7b33241c9a344ed886d0d95

    SHA1

    e49b14e0be0840e520ad3f2609bc6dc8049b03d0

    SHA256

    7a95b4b65be4bb9a6cca15d769f5d682e35844eebf641906ade8dfa60fb1ac36

    SHA512

    2fb791057ead45a47246c235210c82ee1af91f94eb96f22a9134bfe2db94df11635e9b6dec964869092587f056154bea9b8968698aca0f5c34fc5476bcf4fbb8

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\1A0E0C0A120B156E155C15A0A0E160B0A160D.exe
    Filesize

    816KB

    MD5

    892065b2b7b33241c9a344ed886d0d95

    SHA1

    e49b14e0be0840e520ad3f2609bc6dc8049b03d0

    SHA256

    7a95b4b65be4bb9a6cca15d769f5d682e35844eebf641906ade8dfa60fb1ac36

    SHA512

    2fb791057ead45a47246c235210c82ee1af91f94eb96f22a9134bfe2db94df11635e9b6dec964869092587f056154bea9b8968698aca0f5c34fc5476bcf4fbb8

    Download Submit

  • memory/2208-9-0x0000000000400000-0x00000000005AD000-memory.dmp

    Filesize

    1.7MB

    Download

  • memory/2208-11-0x0000000000400000-0x00000000005AD000-memory.dmp

    Filesize

    1.7MB

    Download

  • memory/2208-12-0x0000000000400000-0x00000000005AD000-memory.dmp

    Filesize

    1.7MB

    Download

  • memory/4964-0-0x0000000000400000-0x00000000005AD000-memory.dmp

    Filesize

    1.7MB

    Download

  • memory/4964-2-0x0000000000400000-0x00000000005AD000-memory.dmp

    Filesize

    1.7MB

    Download

  • memory/4964-8-0x0000000000400000-0x00000000005AD000-memory.dmp

    Filesize

    1.7MB

    Download