Analysis

  • max time kernel
    167s
  • max time network
    176s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03-01-2024 20:12

General

  • Target

    3ef813d3b06de0d718960ee0b3cac240.exe

  • Size

    107KB

  • MD5

    3ef813d3b06de0d718960ee0b3cac240

  • SHA1

    0358d69e1bb21aba314832be52aed676511d7224

  • SHA256

    04758db8553c2e207871021008fdba4a99576d3dfc9a1a42bbdfddf2448e333d

  • SHA512

    293d0af7a8dea9e7d32aea0a9f235c8d1eb500983c50eb392ca6bc5f1b1327118aee2eae924ba3ab0676d706ecdf49d6d6763f12879f68fc6cd4d005950652a0

  • SSDEEP

    1536:3WU7JfGXyjPrwpw2ZCZg6oIg/g4Rx/jz6OLVSRepPk7IfsdOApw/8Wt0qfplybjO:H1xUpgZ2J/g4n/FsRecP5pI8WRpyK

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 2 IoCs
  • Drops file in Windows directory 2 IoCs
  • Modifies registry class 5 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3ef813d3b06de0d718960ee0b3cac240.exe
    "C:\Users\Admin\AppData\Local\Temp\3ef813d3b06de0d718960ee0b3cac240.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:804
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c 2.bat
      2⤵
        PID:4632
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c 2.bat
        2⤵
          PID:4168

      Network

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\2.bat

        Filesize

        41B

        MD5

        ba7fbc1af9676442d6da5bdb5afe813c

        SHA1

        151f5f221a3e02f9e51a8cb20495416b79da4c04

        SHA256

        ffac204151edc4de9316c4416df635cd0d68a1d4b33125e6bf32209b0f879816

        SHA512

        94338b36552b9b5f9772b735ebfb8dce8d750ce3c81996f2cd052d0f1e0d9010366d6b711340356506f81d4cd875c8cb0ee71ab0d5c77e22ab9d98893cc70edd

      • C:\Users\Admin\AppData\Local\Temp\2.bat

        Filesize

        52B

        MD5

        79f485589be6c5807d897f83641c45f5

        SHA1

        cf89f8962cbb25c0a22949e6956b2f7340680f59

        SHA256

        7ac89c9449bb50e781081d1bee95b39f786553f79ae651638097748f926ff2ec

        SHA512

        409cf520741545b8674b9a2164741a0a1b00057162ee084f02e0752880995df7494ba1cbc8fedb30cae21c42b8d16cb28d9063d915732c967fdacae12b732278

      • C:\Windows\debug\B831406A9770.dll

        Filesize

        154KB

        MD5

        76a1b33a8596a8817e47bf61727adfa2

        SHA1

        bae46d76c9a70f44bdaa19f8a3bc8dfd477428c6

        SHA256

        36576ad5de7e2361d874173baad78ecf7a0158a8ecd17a57028958590e8cfacf

        SHA512

        64764a1346c79030165731c4b30bdb603e1c11f026576b98256f916d1113f60d40628864eaece5ee6f5bec6359d928a61c566ab99de0957fe77445966bb890b4

      • memory/804-0-0x0000000000400000-0x000000000043F20C-memory.dmp

        Filesize

        252KB

      • memory/804-1-0x0000000000400000-0x000000000043F20C-memory.dmp

        Filesize

        252KB

      • memory/804-4-0x0000000000400000-0x000000000043F20C-memory.dmp

        Filesize

        252KB

      • memory/804-15-0x0000000000A00000-0x0000000000A2B000-memory.dmp

        Filesize

        172KB

      • memory/804-18-0x0000000000400000-0x000000000043F20C-memory.dmp

        Filesize

        252KB

      • memory/804-19-0x0000000000A00000-0x0000000000A2B000-memory.dmp

        Filesize

        172KB

      • memory/804-20-0x0000000000400000-0x000000000043F20C-memory.dmp

        Filesize

        252KB

      • memory/804-21-0x0000000000A00000-0x0000000000A2B000-memory.dmp

        Filesize

        172KB