798e838034dc78b6652c770eab1cb36badd45923f0e7a2f56aa52c7b2c97bd84

Analysis

max time kernel
141s
max time network
110s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25/12/2023, 21:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3ceccae35b010bc5152cdc5e7ca80b23.exe
Size

237KB
MD5

3ceccae35b010bc5152cdc5e7ca80b23
SHA1

34ccc82054c19454729b15ead3c05e7068e73aba
SHA256

798e838034dc78b6652c770eab1cb36badd45923f0e7a2f56aa52c7b2c97bd84
SHA512

51ad41dde897eee9bb5f335f4871766b29118b96e1114ebe7f0016c9fca606280533536179b4f5f58fd096c87249a950fa2b6f43019059ba4c0d2f748491c726
SSDEEP

6144:gJBCors/SsSSVhRqwqLrH7VwBvyhb/E8yE/:TorlsSIhMd/J4J89/

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 6 IoCs

pid	Process
4996	iSVCHOST.exe
4692	iSVCHOST.exe
2572	iSVCHOST.exe
2220	iSVCHOST.exe
4560	iSVCHOST.exe
4496	iSVCHOST.exe

Drops file in System32 directory 7 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\iSVCHOST.exe	3ceccae35b010bc5152cdc5e7ca80b23.exe
File created	C:\Windows\SysWOW64\iSVCHOST.exe	iSVCHOST.exe
File created	C:\Windows\SysWOW64\iSVCHOST.exe	iSVCHOST.exe
File created	C:\Windows\SysWOW64\iSVCHOST.exe	iSVCHOST.exe
File created	C:\Windows\SysWOW64\iSVCHOST.exe	iSVCHOST.exe
File created	C:\Windows\SysWOW64\iSVCHOST.exe	iSVCHOST.exe
File created	C:\Windows\SysWOW64\iSVCHOST.exe	3ceccae35b010bc5152cdc5e7ca80b23.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
232	3ceccae35b010bc5152cdc5e7ca80b23.exe
232	3ceccae35b010bc5152cdc5e7ca80b23.exe
232	3ceccae35b010bc5152cdc5e7ca80b23.exe
232	3ceccae35b010bc5152cdc5e7ca80b23.exe
232	3ceccae35b010bc5152cdc5e7ca80b23.exe
232	3ceccae35b010bc5152cdc5e7ca80b23.exe
232	3ceccae35b010bc5152cdc5e7ca80b23.exe
232	3ceccae35b010bc5152cdc5e7ca80b23.exe
232	3ceccae35b010bc5152cdc5e7ca80b23.exe
232	3ceccae35b010bc5152cdc5e7ca80b23.exe
232	3ceccae35b010bc5152cdc5e7ca80b23.exe
232	3ceccae35b010bc5152cdc5e7ca80b23.exe
232	3ceccae35b010bc5152cdc5e7ca80b23.exe
232	3ceccae35b010bc5152cdc5e7ca80b23.exe
4996	iSVCHOST.exe
4996	iSVCHOST.exe
4996	iSVCHOST.exe
4996	iSVCHOST.exe
4996	iSVCHOST.exe
4996	iSVCHOST.exe
4996	iSVCHOST.exe
4996	iSVCHOST.exe
4996	iSVCHOST.exe
4996	iSVCHOST.exe
4996	iSVCHOST.exe
4996	iSVCHOST.exe
4996	iSVCHOST.exe
4996	iSVCHOST.exe
4692	iSVCHOST.exe
4692	iSVCHOST.exe
4692	iSVCHOST.exe
4692	iSVCHOST.exe
4692	iSVCHOST.exe
4692	iSVCHOST.exe
4692	iSVCHOST.exe
4692	iSVCHOST.exe
4692	iSVCHOST.exe
4692	iSVCHOST.exe
4692	iSVCHOST.exe
4692	iSVCHOST.exe
4692	iSVCHOST.exe
4692	iSVCHOST.exe
4692	iSVCHOST.exe
4692	iSVCHOST.exe
2572	iSVCHOST.exe
2572	iSVCHOST.exe
2572	iSVCHOST.exe
2572	iSVCHOST.exe
2572	iSVCHOST.exe
2572	iSVCHOST.exe
2572	iSVCHOST.exe
2572	iSVCHOST.exe
2572	iSVCHOST.exe
2572	iSVCHOST.exe
2572	iSVCHOST.exe
2572	iSVCHOST.exe
2572	iSVCHOST.exe
2572	iSVCHOST.exe
2572	iSVCHOST.exe
2572	iSVCHOST.exe
2220	iSVCHOST.exe
2220	iSVCHOST.exe
2220	iSVCHOST.exe
2220	iSVCHOST.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 232 wrote to memory of 4996	232	3ceccae35b010bc5152cdc5e7ca80b23.exe	76
PID 232 wrote to memory of 4996	232	3ceccae35b010bc5152cdc5e7ca80b23.exe	76
PID 232 wrote to memory of 4996	232	3ceccae35b010bc5152cdc5e7ca80b23.exe	76
PID 4996 wrote to memory of 4692	4996	iSVCHOST.exe	101
PID 4996 wrote to memory of 4692	4996	iSVCHOST.exe	101
PID 4996 wrote to memory of 4692	4996	iSVCHOST.exe	101
PID 4692 wrote to memory of 2572	4692	iSVCHOST.exe	105
PID 4692 wrote to memory of 2572	4692	iSVCHOST.exe	105
PID 4692 wrote to memory of 2572	4692	iSVCHOST.exe	105
PID 2572 wrote to memory of 2220	2572	iSVCHOST.exe	107
PID 2572 wrote to memory of 2220	2572	iSVCHOST.exe	107
PID 2572 wrote to memory of 2220	2572	iSVCHOST.exe	107
PID 2220 wrote to memory of 4560	2220	iSVCHOST.exe	112
PID 2220 wrote to memory of 4560	2220	iSVCHOST.exe	112
PID 2220 wrote to memory of 4560	2220	iSVCHOST.exe	112
PID 4560 wrote to memory of 4496	4560	iSVCHOST.exe	116
PID 4560 wrote to memory of 4496	4560	iSVCHOST.exe	116
PID 4560 wrote to memory of 4496	4560	iSVCHOST.exe	116

C:\Users\Admin\AppData\Local\Temp\3ceccae35b010bc5152cdc5e7ca80b23.exe
"C:\Users\Admin\AppData\Local\Temp\3ceccae35b010bc5152cdc5e7ca80b23.exe"
1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:232
- C:\Windows\SysWOW64\iSVCHOST.exe
  C:\Windows\system32\iSVCHOST.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4996
- - C:\Windows\SysWOW64\iSVCHOST.exe
    C:\Windows\system32\iSVCHOST.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:4692
  - - C:\Windows\SysWOW64\iSVCHOST.exe
      C:\Windows\system32\iSVCHOST.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:2572
    - - C:\Windows\SysWOW64\iSVCHOST.exe
        
        C:\Windows\system32\iSVCHOST.exe
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:2220
      - C:\Windows\SysWOW64\iSVCHOST.exe
        
        C:\Windows\system32\iSVCHOST.exe
        6⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4560
        
        C:\Windows\SysWOW64\iSVCHOST.exe
        
        C:\Windows\system32\iSVCHOST.exe
        7⤵
        Executes dropped EXE
        
        PID:4496

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\iSVCHOST.exe

Filesize
75KB

MD5
d79a8fc3b23518661611fe2aed15ef20

SHA1
5aab5d656a9ae6bfa8d422db74330beef75ef904

SHA256
638b719c53db197699cdb04bc5c0c072dc4dd8236f600ea2d798f3d8d99647ad

SHA512
081e363326a499e2195a663cd51af4754e97a562e21188ad8eee9be1a275abff5a77e8ea6dff4dc0985cc532daaff059a3818f64123842130ea03e24c7344d22

Download Submit
C:\Windows\SysWOW64\iSVCHOST.exe

Filesize
40KB

MD5
d25521407de873059e3adf13209effd1

SHA1
7f3b2eb069513d48f5b6f68a6ab320794f9a7fdd

SHA256
7fb17db99390dbeb1c4290b3ac80f3e7b7d7dc0da667329b4468fe075a515ce0

SHA512
9f9bd6b5919cd09b02b372aafe97632fb5079b3be112b86172844b0f6033e1a24f3f986be304e95b8889714bd4815ba8da08cfcfbb757df853cd5034efa209cd

Download Submit
C:\Windows\SysWOW64\iSVCHOST.exe

Filesize
57KB

MD5
76fe9b3da13fc1084a07a6d260215321

SHA1
5b3ce35b9ce7b88c1739c924bf7e855cafa64400

SHA256
7121722ad66b9690cfb822ce04722d0fc8c76bb31c26fe206a4a741985c0d70e

SHA512
63d39c56b2b4d3e2155a2fb8d3a1f56c01ea2b4ab6fdcec51a0652e6be5fe2f7441afad9d391fdc7a0244a0f11a1349bf6b753efc91e045ac2355feedceab40f

Download Submit
memory/232-0-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/232-4-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/2220-25-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/2220-22-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/2220-21-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/2572-17-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/2572-16-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/2572-20-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/4496-31-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/4560-26-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/4560-27-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/4560-30-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/4692-15-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/4692-12-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/4692-11-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/4996-10-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/4996-7-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/4996-6-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download