Analysis
-
max time kernel
122s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
06-01-2024 10:08
Static task
static1
Behavioral task
behavioral1
Sample
62118c1a7904986fcdf7f6528bf40d2f.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
62118c1a7904986fcdf7f6528bf40d2f.exe
Resource
win10v2004-20231215-en
General
-
Target
62118c1a7904986fcdf7f6528bf40d2f.exe
-
Size
577KB
-
MD5
62118c1a7904986fcdf7f6528bf40d2f
-
SHA1
24cf6a814ba02a73342d6b6633e3e0a25acf06bd
-
SHA256
1843c1b7e4384901bd8725daf296a716247c8636556b22af619b8485d9e27c57
-
SHA512
e79d15512cba63ee64fa38385db3b1cf5276c747386581d5c270ed26f3738ac280a66284026d265cea1dc0ab808d6e0c6b4981a4699531db83869b41ff8d3458
-
SSDEEP
12288:dtHA0+aLqijURNVD2HCiXhBJPcmlrzoo:dtHAQLqO6VyHXJ7n
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
systemcheck.exepid process 1656 systemcheck.exe -
Loads dropped DLL 1 IoCs
Processes:
62118c1a7904986fcdf7f6528bf40d2f.exepid process 2352 62118c1a7904986fcdf7f6528bf40d2f.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
62118c1a7904986fcdf7f6528bf40d2f.exedescription pid process target process PID 2352 wrote to memory of 1656 2352 62118c1a7904986fcdf7f6528bf40d2f.exe systemcheck.exe PID 2352 wrote to memory of 1656 2352 62118c1a7904986fcdf7f6528bf40d2f.exe systemcheck.exe PID 2352 wrote to memory of 1656 2352 62118c1a7904986fcdf7f6528bf40d2f.exe systemcheck.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\62118c1a7904986fcdf7f6528bf40d2f.exe"C:\Users\Admin\AppData\Local\Temp\62118c1a7904986fcdf7f6528bf40d2f.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2352 -
C:\Users\Public\Music\systemcheck.exeC:\Users\Public\Music\systemcheck.exe2⤵
- Executes dropped EXE
PID:1656
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Public\Music\systemcheck.exeMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e