4fcc9a64d586c6534eaceb5935e38e20c96881e4e90fc29fbbb46c9bdc4e5116

Analysis

max time kernel
118s
max time network
123s
platform
windows7_x64
resource
win7-20231025-en
resource tags

arch:x64arch:x86image:win7-20231025-enlocale:en-usos:windows7-x64system
submitted
21/11/2023, 21:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4fcc9a64d586c6534eaceb5935e38e20c96881e4e90fc29fbbb46c9bdc4e5116.exe
Size

816KB
MD5

aac316903de887646b41713942062cd2
SHA1

3a9875685d6e4fa4a45352d3556c6cf8c3818fb5
SHA256

4fcc9a64d586c6534eaceb5935e38e20c96881e4e90fc29fbbb46c9bdc4e5116
SHA512

8384334b1b9686c3a3d1fbc28f2f1ed6ebf41bec86fc5262bf4531db70304916a4d24e461a54eb17b6aa21cc41c4f1a5187d090d0a3d3b882cc745715ecf8b04
SSDEEP

24576:pY4G2qLMJalsnqShyoo77lUabuSvbDQOOdIxJsG9+:G3XZynV4oDabuWbDQOcIxJJ9+

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1708	1B0C0D0C120F156C155C15E0E0A160A0E160A.exe

Loads dropped DLL 2 IoCs

pid	Process
1892	4fcc9a64d586c6534eaceb5935e38e20c96881e4e90fc29fbbb46c9bdc4e5116.exe
1892	4fcc9a64d586c6534eaceb5935e38e20c96881e4e90fc29fbbb46c9bdc4e5116.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
1892	4fcc9a64d586c6534eaceb5935e38e20c96881e4e90fc29fbbb46c9bdc4e5116.exe
1708	1B0C0D0C120F156C155C15E0E0A160A0E160A.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1892 wrote to memory of 1708	1892	4fcc9a64d586c6534eaceb5935e38e20c96881e4e90fc29fbbb46c9bdc4e5116.exe	28
PID 1892 wrote to memory of 1708	1892	4fcc9a64d586c6534eaceb5935e38e20c96881e4e90fc29fbbb46c9bdc4e5116.exe	28
PID 1892 wrote to memory of 1708	1892	4fcc9a64d586c6534eaceb5935e38e20c96881e4e90fc29fbbb46c9bdc4e5116.exe	28
PID 1892 wrote to memory of 1708	1892	4fcc9a64d586c6534eaceb5935e38e20c96881e4e90fc29fbbb46c9bdc4e5116.exe	28

C:\Users\Admin\AppData\Local\Temp\4fcc9a64d586c6534eaceb5935e38e20c96881e4e90fc29fbbb46c9bdc4e5116.exe
"C:\Users\Admin\AppData\Local\Temp\4fcc9a64d586c6534eaceb5935e38e20c96881e4e90fc29fbbb46c9bdc4e5116.exe"
1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:1892
- C:\Users\Admin\AppData\Local\Temp\1B0C0D0C120F156C155C15E0E0A160A0E160A.exe
  C:\Users\Admin\AppData\Local\Temp\1B0C0D0C120F156C155C15E0E0A160A0E160A.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:1708

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\1B0C0D0C120F156C155C15E0E0A160A0E160A.exe

Filesize
816KB

MD5
f0da1442a179d4074cfb10acffa66631

SHA1
e2fca5d7b810ad9086a23d3db7312112a202e6e9

SHA256
ffbd4efb7dbcf2c16fa6166f885acac824f49a62cb192fe4a1170430b7e9f535

SHA512
18429246efa19dc7d3d3d7bcf5849582fd0c930db0fb366960429fdeb983d20b478418083450d75ffb18b8c0bf3f2eb6f9b0f71cbb582051594b21a2320efec6

Download Submit
C:\Users\Admin\AppData\Local\Temp\1B0C0D0C120F156C155C15E0E0A160A0E160A.exe

Filesize
816KB

MD5
f0da1442a179d4074cfb10acffa66631

SHA1
e2fca5d7b810ad9086a23d3db7312112a202e6e9

SHA256
ffbd4efb7dbcf2c16fa6166f885acac824f49a62cb192fe4a1170430b7e9f535

SHA512
18429246efa19dc7d3d3d7bcf5849582fd0c930db0fb366960429fdeb983d20b478418083450d75ffb18b8c0bf3f2eb6f9b0f71cbb582051594b21a2320efec6

Download Submit
\Users\Admin\AppData\Local\Temp\1B0C0D0C120F156C155C15E0E0A160A0E160A.exe

Filesize
816KB

MD5
f0da1442a179d4074cfb10acffa66631

SHA1
e2fca5d7b810ad9086a23d3db7312112a202e6e9

SHA256
ffbd4efb7dbcf2c16fa6166f885acac824f49a62cb192fe4a1170430b7e9f535

SHA512
18429246efa19dc7d3d3d7bcf5849582fd0c930db0fb366960429fdeb983d20b478418083450d75ffb18b8c0bf3f2eb6f9b0f71cbb582051594b21a2320efec6

Download Submit
\Users\Admin\AppData\Local\Temp\1B0C0D0C120F156C155C15E0E0A160A0E160A.exe

Filesize
816KB

MD5
f0da1442a179d4074cfb10acffa66631

SHA1
e2fca5d7b810ad9086a23d3db7312112a202e6e9

SHA256
ffbd4efb7dbcf2c16fa6166f885acac824f49a62cb192fe4a1170430b7e9f535

SHA512
18429246efa19dc7d3d3d7bcf5849582fd0c930db0fb366960429fdeb983d20b478418083450d75ffb18b8c0bf3f2eb6f9b0f71cbb582051594b21a2320efec6

Download Submit
memory/1708-16-0x0000000000400000-0x00000000005AD000-memory.dmp

Filesize
1.7MB

Download
memory/1708-14-0x0000000000400000-0x00000000005AD000-memory.dmp

Filesize
1.7MB

Download
memory/1708-17-0x0000000000400000-0x00000000005AD000-memory.dmp

Filesize
1.7MB

Download
memory/1892-0-0x0000000000400000-0x00000000005AD000-memory.dmp

Filesize
1.7MB

Download
memory/1892-2-0x0000000000400000-0x00000000005AD000-memory.dmp

Filesize
1.7MB

Download
memory/1892-13-0x0000000000400000-0x00000000005AD000-memory.dmp

Filesize
1.7MB

Download
memory/1892-11-0x0000000001FF0000-0x000000000219D000-memory.dmp

Filesize
1.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads