39a4d438fa7aeb55603f6000402bc365a5309adfb494fcdc676cc3a9737db90f

Analysis

max time kernel
143s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
21/11/2023, 11:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

39a4d438fa7aeb55603f6000402bc365a5309adfb494fcdc676cc3a9737db90f.exe
Size

2.4MB
MD5

b463fb72a974f4580d29e19fb2494db8
SHA1

415fcb042059de9ed2e823950876c2847102162c
SHA256

39a4d438fa7aeb55603f6000402bc365a5309adfb494fcdc676cc3a9737db90f
SHA512

1ac70466958556fc5a263bf37189c69a5f43f17e574f383b4eba5ddbc8475118458a5d62eda8f0b716699f61ea25af00a59fdaa461de3a13632d32337df5602b
SSDEEP

24576:mWO3NfIJv/lOt97/S0yCLRCzfPXCsRaYAM/lfkykiMh9M0Wj2XugCAYph/pprwtn:mbfIDOtJSICusRDAMNMh9M0u2utxWF

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1076	39a4d438fa7aeb55603f6000402bc365a5309adfb494fcdc676cc3a9737db90f.exe

Loads dropped DLL 2 IoCs

pid	Process
4396	39a4d438fa7aeb55603f6000402bc365a5309adfb494fcdc676cc3a9737db90f.exe
1076	39a4d438fa7aeb55603f6000402bc365a5309adfb494fcdc676cc3a9737db90f.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Fonts\tprsjv.dll	39a4d438fa7aeb55603f6000402bc365a5309adfb494fcdc676cc3a9737db90f.exe
File created	C:\Windows\Fonts\yclacf.dll	39a4d438fa7aeb55603f6000402bc365a5309adfb494fcdc676cc3a9737db90f.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4396	39a4d438fa7aeb55603f6000402bc365a5309adfb494fcdc676cc3a9737db90f.exe
4396	39a4d438fa7aeb55603f6000402bc365a5309adfb494fcdc676cc3a9737db90f.exe
4396	39a4d438fa7aeb55603f6000402bc365a5309adfb494fcdc676cc3a9737db90f.exe
4396	39a4d438fa7aeb55603f6000402bc365a5309adfb494fcdc676cc3a9737db90f.exe
4396	39a4d438fa7aeb55603f6000402bc365a5309adfb494fcdc676cc3a9737db90f.exe
4396	39a4d438fa7aeb55603f6000402bc365a5309adfb494fcdc676cc3a9737db90f.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4396	39a4d438fa7aeb55603f6000402bc365a5309adfb494fcdc676cc3a9737db90f.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
4396	39a4d438fa7aeb55603f6000402bc365a5309adfb494fcdc676cc3a9737db90f.exe
4396	39a4d438fa7aeb55603f6000402bc365a5309adfb494fcdc676cc3a9737db90f.exe
4396	39a4d438fa7aeb55603f6000402bc365a5309adfb494fcdc676cc3a9737db90f.exe
1076	39a4d438fa7aeb55603f6000402bc365a5309adfb494fcdc676cc3a9737db90f.exe
1076	39a4d438fa7aeb55603f6000402bc365a5309adfb494fcdc676cc3a9737db90f.exe
1076	39a4d438fa7aeb55603f6000402bc365a5309adfb494fcdc676cc3a9737db90f.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4396 wrote to memory of 1076	4396	39a4d438fa7aeb55603f6000402bc365a5309adfb494fcdc676cc3a9737db90f.exe	85
PID 4396 wrote to memory of 1076	4396	39a4d438fa7aeb55603f6000402bc365a5309adfb494fcdc676cc3a9737db90f.exe	85
PID 4396 wrote to memory of 1076	4396	39a4d438fa7aeb55603f6000402bc365a5309adfb494fcdc676cc3a9737db90f.exe	85

C:\Users\Admin\AppData\Local\Temp\39a4d438fa7aeb55603f6000402bc365a5309adfb494fcdc676cc3a9737db90f.exe
"C:\Users\Admin\AppData\Local\Temp\39a4d438fa7aeb55603f6000402bc365a5309adfb494fcdc676cc3a9737db90f.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4396
- C:\Users\Admin\AppData\Local\Temp\39a4d438fa7aeb55603f6000402bc365a5309adfb494fcdc676cc3a9737db90f.exe
  C:\Users\Admin\AppData\Local\Temp\39a4d438fa7aeb55603f6000402bc365a5309adfb494fcdc676cc3a9737db90f.exe --
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  - Suspicious use of SetWindowsHookEx
  PID:1076

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\39a4d438fa7aeb55603f6000402bc365a5309adfb494fcdc676cc3a9737db90f.exe

Filesize
2.4MB

MD5
1e39c2df0849ccda4c236d18860a0247

SHA1
6e6235f7f972947f7375fcc70d32ad0aa0bc6c1c

SHA256
b9f803c1aa9cf70252403bd8bff5bab0b4c38ebcc37cab79830e5318cb8510cb

SHA512
b9de1b8e3a9337b7599d0b784656e4c620a9570f7dffa0d994dc7fc4768ce02877dcc3f2a5107e697d649c04bd807be7a62ede0b9599ef93fc41930b2a4670d5

Download Submit
C:\Windows\Fonts\tprsjv.dll

Filesize
1.4MB

MD5
736228b33e34445eaf8c16b864294c27

SHA1
6c77cb3c3f6ed94fc61d03383fa19f09a56b3c77

SHA256
c8015c473252a432d131bf2dd53a1172acdc05870de399f4456dce3edbc847cc

SHA512
7849dcccc0f59e89930b57b921ad3733816b6f857c2ae0905f6e1e3221603aba9fd382a3f255e76fb06128376f8f9eb79a0a30d4ea8b476d86a0163535644cec

Download Submit
C:\Windows\Fonts\yclacf.dll

Filesize
1.4MB

MD5
736228b33e34445eaf8c16b864294c27

SHA1
6c77cb3c3f6ed94fc61d03383fa19f09a56b3c77

SHA256
c8015c473252a432d131bf2dd53a1172acdc05870de399f4456dce3edbc847cc

SHA512
7849dcccc0f59e89930b57b921ad3733816b6f857c2ae0905f6e1e3221603aba9fd382a3f255e76fb06128376f8f9eb79a0a30d4ea8b476d86a0163535644cec

Download Submit
C:\Windows\Fonts\yclacf.dll

Filesize
1.4MB

MD5
736228b33e34445eaf8c16b864294c27

SHA1
6c77cb3c3f6ed94fc61d03383fa19f09a56b3c77

SHA256
c8015c473252a432d131bf2dd53a1172acdc05870de399f4456dce3edbc847cc

SHA512
7849dcccc0f59e89930b57b921ad3733816b6f857c2ae0905f6e1e3221603aba9fd382a3f255e76fb06128376f8f9eb79a0a30d4ea8b476d86a0163535644cec

Download Submit