c0371f3a4c640bf6dcf4c5b9a1cd9dc71ac7fa588e13323ce425bb077153ce52

Analysis

max time kernel
141s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
11/11/2023, 10:48

Target

c0371f3a4c640bf6dcf4c5b9a1cd9dc71ac7fa588e13323ce425bb077153ce52.exe
Size

1.5MB
MD5

d2f938a79fafc8b75db1387dcc9fe874
SHA1

0775bb51fec54adf4c42a87144ffd0beff2136ca
SHA256

c0371f3a4c640bf6dcf4c5b9a1cd9dc71ac7fa588e13323ce425bb077153ce52
SHA512

2e32d451c80deb584a593140e504918b60b568207d008156323ee2facdd0695e21ddc27057c766a7eae0774b207f029135329c2b860a214d18037aa7f41f5f2b
SSDEEP

24576:TLcl95uYLUhgkrCUZmnLkAltAIO9qKC1OB0iOCd1xMqbuWGYskjbL/5Ffd0:fctuYLEVCYmnLltdGJ0HCdfDGPUh

Score

8^/10

Drops file in Drivers directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	kqubo.exe
File created	C:\Windows\System32\drivers\etc\hosts	kqubo.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts.ics	kqubo.exe
File created	C:\Windows\System32\drivers\etc\hosts.ics	kqubo.exe

Deletes itself 1 IoCs

pid	Process
4572	kqubo.exe

Executes dropped EXE 1 IoCs

pid	Process
4572	kqubo.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3192 wrote to memory of 4572	3192	c0371f3a4c640bf6dcf4c5b9a1cd9dc71ac7fa588e13323ce425bb077153ce52.exe	89
PID 3192 wrote to memory of 4572	3192	c0371f3a4c640bf6dcf4c5b9a1cd9dc71ac7fa588e13323ce425bb077153ce52.exe	89
PID 3192 wrote to memory of 4572	3192	c0371f3a4c640bf6dcf4c5b9a1cd9dc71ac7fa588e13323ce425bb077153ce52.exe	89

C:\Users\Admin\AppData\Local\Temp\c0371f3a4c640bf6dcf4c5b9a1cd9dc71ac7fa588e13323ce425bb077153ce52.exe
"C:\Users\Admin\AppData\Local\Temp\c0371f3a4c640bf6dcf4c5b9a1cd9dc71ac7fa588e13323ce425bb077153ce52.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3192
- C:\Users\Admin\AppData\Local\Temp\kqubo.exe
  "C:\Users\Admin\AppData\Local\Temp\c0371f3a4c640bf6dcf4c5b9a1cd9dc71ac7fa588e13323ce425bb077153ce52.exe"
  2⤵
  - Drops file in Drivers directory
  - Deletes itself
  - Executes dropped EXE
  PID:4572

C:\Users\Admin\AppData\Local\Temp\kqubo.exe

Filesize
1.5MB

MD5
d2f938a79fafc8b75db1387dcc9fe874

SHA1
0775bb51fec54adf4c42a87144ffd0beff2136ca

SHA256
c0371f3a4c640bf6dcf4c5b9a1cd9dc71ac7fa588e13323ce425bb077153ce52

SHA512
2e32d451c80deb584a593140e504918b60b568207d008156323ee2facdd0695e21ddc27057c766a7eae0774b207f029135329c2b860a214d18037aa7f41f5f2b

Download Submit
C:\Users\Admin\AppData\Local\Temp\kqubo.exe

Filesize
1.5MB

MD5
d2f938a79fafc8b75db1387dcc9fe874

SHA1
0775bb51fec54adf4c42a87144ffd0beff2136ca

SHA256
c0371f3a4c640bf6dcf4c5b9a1cd9dc71ac7fa588e13323ce425bb077153ce52

SHA512
2e32d451c80deb584a593140e504918b60b568207d008156323ee2facdd0695e21ddc27057c766a7eae0774b207f029135329c2b860a214d18037aa7f41f5f2b

Download Submit
memory/3192-0-0x0000000000D90000-0x000000000114A000-memory.dmp

Filesize
3.7MB

Download
memory/3192-6-0x0000000000D90000-0x000000000114A000-memory.dmp

Filesize
3.7MB

Download
memory/4572-8-0x00000000001A0000-0x000000000055A000-memory.dmp

Filesize
3.7MB

Download
memory/4572-15-0x00000000001A0000-0x000000000055A000-memory.dmp

Filesize
3.7MB

Download