3867a365bd165f8ebbc1f8d162a2e5cd3c37334f52ed5201b8cc1501c1cc13f4

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20231025-en
resource tags

arch:x64arch:x86image:win7-20231025-enlocale:en-usos:windows7-x64system
submitted
15-11-2023 06:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3867a365bd165f8ebbc1f8d162a2e5cd3c37334f52ed5201b8cc1501c1cc13f4.exe
Size

816KB
MD5

4a418ed7046ac386525f9f016e099804
SHA1

995eaaf958286523c93240f6ce8f75af19a5b6e6
SHA256

3867a365bd165f8ebbc1f8d162a2e5cd3c37334f52ed5201b8cc1501c1cc13f4
SHA512

17e7fffbc20bd608395cdbe8ce292ee43ef3f5fb73657e3726a502d5100d82f1f823d58c4245b7b8babb310602441f3228d952d77cf103eb44836c38d5916da3
SSDEEP

24576:WY4G2qLMJalsnqShyoo77lUabuSvbDQOOdIxJsG90:33XZynV4oDabuWbDQOcIxJJ90

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1744	1C0C0E0B120E156D155C15A0F0B160D0A160D.exe

Loads dropped DLL 2 IoCs

pid	Process
1944	3867a365bd165f8ebbc1f8d162a2e5cd3c37334f52ed5201b8cc1501c1cc13f4.exe
1944	3867a365bd165f8ebbc1f8d162a2e5cd3c37334f52ed5201b8cc1501c1cc13f4.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
1944	3867a365bd165f8ebbc1f8d162a2e5cd3c37334f52ed5201b8cc1501c1cc13f4.exe
1744	1C0C0E0B120E156D155C15A0F0B160D0A160D.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1944 wrote to memory of 1744	1944	3867a365bd165f8ebbc1f8d162a2e5cd3c37334f52ed5201b8cc1501c1cc13f4.exe	28
PID 1944 wrote to memory of 1744	1944	3867a365bd165f8ebbc1f8d162a2e5cd3c37334f52ed5201b8cc1501c1cc13f4.exe	28
PID 1944 wrote to memory of 1744	1944	3867a365bd165f8ebbc1f8d162a2e5cd3c37334f52ed5201b8cc1501c1cc13f4.exe	28
PID 1944 wrote to memory of 1744	1944	3867a365bd165f8ebbc1f8d162a2e5cd3c37334f52ed5201b8cc1501c1cc13f4.exe	28

C:\Users\Admin\AppData\Local\Temp\3867a365bd165f8ebbc1f8d162a2e5cd3c37334f52ed5201b8cc1501c1cc13f4.exe
"C:\Users\Admin\AppData\Local\Temp\3867a365bd165f8ebbc1f8d162a2e5cd3c37334f52ed5201b8cc1501c1cc13f4.exe"
1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:1944
- C:\Users\Admin\AppData\Local\Temp\1C0C0E0B120E156D155C15A0F0B160D0A160D.exe
  C:\Users\Admin\AppData\Local\Temp\1C0C0E0B120E156D155C15A0F0B160D0A160D.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:1744

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\1C0C0E0B120E156D155C15A0F0B160D0A160D.exe

Filesize
816KB

MD5
c97bc6566b15803f974b3fd4fb521e0f

SHA1
17ec10c62fd27748c0324385278fb63ed1beb7c1

SHA256
7684a52760d5f959c2c9782a228c036799bb70667455fb89b99724b7411c0b27

SHA512
89000ececb655df916ddc03d5d27db831cd3a758056e558e856c526734932e165a6818113f6143cb9f55c82347fe2b0a4cbd3015c74c223b3e0ebf0bcdc4bf62

Download Submit
C:\Users\Admin\AppData\Local\Temp\1C0C0E0B120E156D155C15A0F0B160D0A160D.exe

Filesize
816KB

MD5
c97bc6566b15803f974b3fd4fb521e0f

SHA1
17ec10c62fd27748c0324385278fb63ed1beb7c1

SHA256
7684a52760d5f959c2c9782a228c036799bb70667455fb89b99724b7411c0b27

SHA512
89000ececb655df916ddc03d5d27db831cd3a758056e558e856c526734932e165a6818113f6143cb9f55c82347fe2b0a4cbd3015c74c223b3e0ebf0bcdc4bf62

Download Submit
\Users\Admin\AppData\Local\Temp\1C0C0E0B120E156D155C15A0F0B160D0A160D.exe

Filesize
816KB

MD5
c97bc6566b15803f974b3fd4fb521e0f

SHA1
17ec10c62fd27748c0324385278fb63ed1beb7c1

SHA256
7684a52760d5f959c2c9782a228c036799bb70667455fb89b99724b7411c0b27

SHA512
89000ececb655df916ddc03d5d27db831cd3a758056e558e856c526734932e165a6818113f6143cb9f55c82347fe2b0a4cbd3015c74c223b3e0ebf0bcdc4bf62

Download Submit
\Users\Admin\AppData\Local\Temp\1C0C0E0B120E156D155C15A0F0B160D0A160D.exe

Filesize
816KB

MD5
c97bc6566b15803f974b3fd4fb521e0f

SHA1
17ec10c62fd27748c0324385278fb63ed1beb7c1

SHA256
7684a52760d5f959c2c9782a228c036799bb70667455fb89b99724b7411c0b27

SHA512
89000ececb655df916ddc03d5d27db831cd3a758056e558e856c526734932e165a6818113f6143cb9f55c82347fe2b0a4cbd3015c74c223b3e0ebf0bcdc4bf62

Download Submit
memory/1744-13-0x0000000000400000-0x00000000005AD000-memory.dmp

Filesize
1.7MB

Download
memory/1744-15-0x0000000000400000-0x00000000005AD000-memory.dmp

Filesize
1.7MB

Download
memory/1744-16-0x0000000000400000-0x00000000005AD000-memory.dmp

Filesize
1.7MB

Download
memory/1944-0-0x0000000000400000-0x00000000005AD000-memory.dmp

Filesize
1.7MB

Download
memory/1944-2-0x0000000000400000-0x00000000005AD000-memory.dmp

Filesize
1.7MB

Download
memory/1944-11-0x0000000000400000-0x00000000005AD000-memory.dmp

Filesize
1.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads