Analysis
-
max time kernel
121s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20231020-en -
resource tags
arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system -
submitted
05-11-2023 02:10
Behavioral task
behavioral1
Sample
9b6be74c2c144f8bcb92c8350855d35c14bb7f2b727551c3dd5c8054c4136e3f.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
9b6be74c2c144f8bcb92c8350855d35c14bb7f2b727551c3dd5c8054c4136e3f.exe
Resource
win10v2004-20231023-en
General
-
Target
9b6be74c2c144f8bcb92c8350855d35c14bb7f2b727551c3dd5c8054c4136e3f.exe
-
Size
10.4MB
-
MD5
00c69252bc0e896e2a8b0a9a3d68e41e
-
SHA1
37d01981b79ac2e397ef7264d6dcf568634c01c7
-
SHA256
9b6be74c2c144f8bcb92c8350855d35c14bb7f2b727551c3dd5c8054c4136e3f
-
SHA512
a7701f865063cf73c2fe57265931f9177b69f34599903204cae4cc7f59de22de07bc0880f0274fc8663b4b772478fdd7b677e9f7beb37733ad8a63037157f7c2
-
SSDEEP
196608:pINtwZV9xnc45SyY+GOe42yOmL2Vmd6+D/2c/f/+SHSEqEEQ+Knm/Z1y:otS9xnnSyY+k4tOmL2Vmd6m+c/eFR4C1
Malware Config
Signatures
-
Loads dropped DLL 7 IoCs
Processes:
9b6be74c2c144f8bcb92c8350855d35c14bb7f2b727551c3dd5c8054c4136e3f.exepid process 2604 9b6be74c2c144f8bcb92c8350855d35c14bb7f2b727551c3dd5c8054c4136e3f.exe 2604 9b6be74c2c144f8bcb92c8350855d35c14bb7f2b727551c3dd5c8054c4136e3f.exe 2604 9b6be74c2c144f8bcb92c8350855d35c14bb7f2b727551c3dd5c8054c4136e3f.exe 2604 9b6be74c2c144f8bcb92c8350855d35c14bb7f2b727551c3dd5c8054c4136e3f.exe 2604 9b6be74c2c144f8bcb92c8350855d35c14bb7f2b727551c3dd5c8054c4136e3f.exe 2604 9b6be74c2c144f8bcb92c8350855d35c14bb7f2b727551c3dd5c8054c4136e3f.exe 2604 9b6be74c2c144f8bcb92c8350855d35c14bb7f2b727551c3dd5c8054c4136e3f.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
9b6be74c2c144f8bcb92c8350855d35c14bb7f2b727551c3dd5c8054c4136e3f.exedescription pid process target process PID 3060 wrote to memory of 2604 3060 9b6be74c2c144f8bcb92c8350855d35c14bb7f2b727551c3dd5c8054c4136e3f.exe 9b6be74c2c144f8bcb92c8350855d35c14bb7f2b727551c3dd5c8054c4136e3f.exe PID 3060 wrote to memory of 2604 3060 9b6be74c2c144f8bcb92c8350855d35c14bb7f2b727551c3dd5c8054c4136e3f.exe 9b6be74c2c144f8bcb92c8350855d35c14bb7f2b727551c3dd5c8054c4136e3f.exe PID 3060 wrote to memory of 2604 3060 9b6be74c2c144f8bcb92c8350855d35c14bb7f2b727551c3dd5c8054c4136e3f.exe 9b6be74c2c144f8bcb92c8350855d35c14bb7f2b727551c3dd5c8054c4136e3f.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9b6be74c2c144f8bcb92c8350855d35c14bb7f2b727551c3dd5c8054c4136e3f.exe"C:\Users\Admin\AppData\Local\Temp\9b6be74c2c144f8bcb92c8350855d35c14bb7f2b727551c3dd5c8054c4136e3f.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3060 -
C:\Users\Admin\AppData\Local\Temp\9b6be74c2c144f8bcb92c8350855d35c14bb7f2b727551c3dd5c8054c4136e3f.exe"C:\Users\Admin\AppData\Local\Temp\9b6be74c2c144f8bcb92c8350855d35c14bb7f2b727551c3dd5c8054c4136e3f.exe"2⤵
- Loads dropped DLL
PID:2604
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\_MEI30602\api-ms-win-core-file-l1-2-0.dllFilesize
18KB
MD549c3ffd47257dbcb67a6be9ee112ba7f
SHA104669214375b25e2dc8a3635484e6eeb206bc4eb
SHA256322d963d2a2aefd784e99697c59d494853d69bed8efd4b445f59292930a6b165
SHA512bda5e6c669b04aaed89538a982ef430cef389237c6c1d670819a22b2a20bf3c22aef5cb4e73ef7837cbbd89d870693899f97cb538122059c885f4b19b7860a98
-
C:\Users\Admin\AppData\Local\Temp\_MEI30602\api-ms-win-core-file-l2-1-0.dllFilesize
18KB
MD5bfffa7117fd9b1622c66d949bac3f1d7
SHA1402b7b8f8dcfd321b1d12fc85a1ee5137a5569b2
SHA2561ea267a2e6284f17dd548c6f2285e19f7edb15d6e737a55391140ce5cb95225e
SHA512b319cc7b436b1be165cdf6ffcab8a87fe29de78f7e0b14c8f562be160481fb5483289bd5956fdc1d8660da7a3f86d8eede35c6cc2b7c3d4c852decf4b2dcdb7f
-
C:\Users\Admin\AppData\Local\Temp\_MEI30602\api-ms-win-core-localization-l1-2-0.dllFilesize
20KB
MD5588bd2a8e0152e0918742c1a69038f1d
SHA19874398548891f6a08fc06437996f84eb7495783
SHA256a07cc878ab5595aacd4ab229a6794513f897bd7ad14bcec353793379146b2094
SHA51232ffe64c697f94c4db641ab3e20b0f522cf3eba9863164f1f6271d2f32529250292a16be95f32d852480bd1b59b8b0554c1e7fd7c7a336f56c048f4f56e4d62f
-
C:\Users\Admin\AppData\Local\Temp\_MEI30602\api-ms-win-core-processthreads-l1-1-1.dllFilesize
18KB
MD5d699333637db92d319661286df7cc39e
SHA10bffb9ed366853e7019452644d26e8e8f236241b
SHA256fe760614903e6d46a1be508dccb65cf6929d792a1db2c365fc937f2a8a240504
SHA5126fa9ff0e45f803faf3eb9908e810a492f6f971cb96d58c06f408980ab40cba138b52d853aa0e3c68474053690dfafa1817f4b4c8fb728d613696b6c516fa0f51
-
C:\Users\Admin\AppData\Local\Temp\_MEI30602\api-ms-win-core-timezone-l1-1-0.dllFilesize
18KB
MD5f62b66f451f2daa8410ad62d453fa0a2
SHA14bf13db65943e708690d6256d7ddd421cc1cc72b
SHA25648eb5b52227b6fb5be70cb34009c8da68356b62f3e707db56af957338ba82720
SHA512d64c2a72adf40bd451341552e7e6958779de3054b0cf676b876c3ba7b86147aecba051ac08adc0c3bfb2779109f87dca706c43de3ce36e05af0ddee02bbbf419
-
C:\Users\Admin\AppData\Local\Temp\_MEI30602\python310.dllFilesize
4.3MB
MD5c80b5cb43e5fe7948c3562c1fff1254e
SHA1f73cb1fb9445c96ecd56b984a1822e502e71ab9d
SHA256058925e4bbfcb460a3c00ec824b8390583baef0c780a7c7ff01d43d9eec45f20
SHA512faa97a9d5d2a0bf78123f19f8657c24921b907268938c26f79e1df6d667f7bee564259a3a11022e8629996406cda9fa00434bb2b1de3e10b9bddc59708dbad81
-
C:\Users\Admin\AppData\Local\Temp\_MEI30602\ucrtbase.dllFilesize
992KB
MD50e0bac3d1dcc1833eae4e3e4cf83c4ef
SHA14189f4459c54e69c6d3155a82524bda7549a75a6
SHA2568a91052ef261b5fbf3223ae9ce789af73dfe1e9b0ba5bdbc4d564870a24f2bae
SHA512a45946e3971816f66dd7ea3788aacc384a9e95011500b458212dc104741315b85659e0d56a41570731d338bdf182141c093d3ced222c007038583ceb808e26fd
-
\Users\Admin\AppData\Local\Temp\_MEI30602\api-ms-win-core-file-l1-2-0.dllFilesize
18KB
MD549c3ffd47257dbcb67a6be9ee112ba7f
SHA104669214375b25e2dc8a3635484e6eeb206bc4eb
SHA256322d963d2a2aefd784e99697c59d494853d69bed8efd4b445f59292930a6b165
SHA512bda5e6c669b04aaed89538a982ef430cef389237c6c1d670819a22b2a20bf3c22aef5cb4e73ef7837cbbd89d870693899f97cb538122059c885f4b19b7860a98
-
\Users\Admin\AppData\Local\Temp\_MEI30602\api-ms-win-core-file-l2-1-0.dllFilesize
18KB
MD5bfffa7117fd9b1622c66d949bac3f1d7
SHA1402b7b8f8dcfd321b1d12fc85a1ee5137a5569b2
SHA2561ea267a2e6284f17dd548c6f2285e19f7edb15d6e737a55391140ce5cb95225e
SHA512b319cc7b436b1be165cdf6ffcab8a87fe29de78f7e0b14c8f562be160481fb5483289bd5956fdc1d8660da7a3f86d8eede35c6cc2b7c3d4c852decf4b2dcdb7f
-
\Users\Admin\AppData\Local\Temp\_MEI30602\api-ms-win-core-localization-l1-2-0.dllFilesize
20KB
MD5588bd2a8e0152e0918742c1a69038f1d
SHA19874398548891f6a08fc06437996f84eb7495783
SHA256a07cc878ab5595aacd4ab229a6794513f897bd7ad14bcec353793379146b2094
SHA51232ffe64c697f94c4db641ab3e20b0f522cf3eba9863164f1f6271d2f32529250292a16be95f32d852480bd1b59b8b0554c1e7fd7c7a336f56c048f4f56e4d62f
-
\Users\Admin\AppData\Local\Temp\_MEI30602\api-ms-win-core-processthreads-l1-1-1.dllFilesize
18KB
MD5d699333637db92d319661286df7cc39e
SHA10bffb9ed366853e7019452644d26e8e8f236241b
SHA256fe760614903e6d46a1be508dccb65cf6929d792a1db2c365fc937f2a8a240504
SHA5126fa9ff0e45f803faf3eb9908e810a492f6f971cb96d58c06f408980ab40cba138b52d853aa0e3c68474053690dfafa1817f4b4c8fb728d613696b6c516fa0f51
-
\Users\Admin\AppData\Local\Temp\_MEI30602\api-ms-win-core-timezone-l1-1-0.dllFilesize
18KB
MD5f62b66f451f2daa8410ad62d453fa0a2
SHA14bf13db65943e708690d6256d7ddd421cc1cc72b
SHA25648eb5b52227b6fb5be70cb34009c8da68356b62f3e707db56af957338ba82720
SHA512d64c2a72adf40bd451341552e7e6958779de3054b0cf676b876c3ba7b86147aecba051ac08adc0c3bfb2779109f87dca706c43de3ce36e05af0ddee02bbbf419
-
\Users\Admin\AppData\Local\Temp\_MEI30602\python310.dllFilesize
4.3MB
MD5c80b5cb43e5fe7948c3562c1fff1254e
SHA1f73cb1fb9445c96ecd56b984a1822e502e71ab9d
SHA256058925e4bbfcb460a3c00ec824b8390583baef0c780a7c7ff01d43d9eec45f20
SHA512faa97a9d5d2a0bf78123f19f8657c24921b907268938c26f79e1df6d667f7bee564259a3a11022e8629996406cda9fa00434bb2b1de3e10b9bddc59708dbad81
-
\Users\Admin\AppData\Local\Temp\_MEI30602\ucrtbase.dllFilesize
992KB
MD50e0bac3d1dcc1833eae4e3e4cf83c4ef
SHA14189f4459c54e69c6d3155a82524bda7549a75a6
SHA2568a91052ef261b5fbf3223ae9ce789af73dfe1e9b0ba5bdbc4d564870a24f2bae
SHA512a45946e3971816f66dd7ea3788aacc384a9e95011500b458212dc104741315b85659e0d56a41570731d338bdf182141c093d3ced222c007038583ceb808e26fd