9e298f797a9272e30316fc14dada452d0c32988708e96974fabaad3bc834fffd

Analysis

max time kernel
149s
max time network
118s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
17-01-2024 22:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

63c457f491126c17dcce5cd5105bc660.exe
Size

29KB
MD5

63c457f491126c17dcce5cd5105bc660
SHA1

affbd7c32916a0bf0bb881424b1074dc0c44eb7a
SHA256

9e298f797a9272e30316fc14dada452d0c32988708e96974fabaad3bc834fffd
SHA512

ff2aa41b608f62f161ad41aaad7ea677d6e0b386c7247d64dcdbe4ed1b60523fd75370aec572385ea6f2b50e14b195c141d054ea72294053fdc08678a96b40c0
SSDEEP

768:Ikb9lbBEns+m1v9Nseq+XeYvWMpzroUTtO9h1HQ/:Ikb9lbOnsj1vFqUzvnQ6Eh1

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2108	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2204	svhost32.exe

Loads dropped DLL 3 IoCs

pid	Process
2148	63c457f491126c17dcce5cd5105bc660.exe
2148	63c457f491126c17dcce5cd5105bc660.exe
2204	svhost32.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\dllwm.dll	svhost32.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\svhost32.exe	63c457f491126c17dcce5cd5105bc660.exe
File opened for modification	C:\Program Files\svhost32.exe	63c457f491126c17dcce5cd5105bc660.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2148	63c457f491126c17dcce5cd5105bc660.exe
2148	63c457f491126c17dcce5cd5105bc660.exe
2148	63c457f491126c17dcce5cd5105bc660.exe
2148	63c457f491126c17dcce5cd5105bc660.exe
2148	63c457f491126c17dcce5cd5105bc660.exe
2148	63c457f491126c17dcce5cd5105bc660.exe
2148	63c457f491126c17dcce5cd5105bc660.exe
2148	63c457f491126c17dcce5cd5105bc660.exe
2148	63c457f491126c17dcce5cd5105bc660.exe
2148	63c457f491126c17dcce5cd5105bc660.exe
2204	svhost32.exe
2204	svhost32.exe
2204	svhost32.exe
2204	svhost32.exe
2204	svhost32.exe
2204	svhost32.exe
2204	svhost32.exe
2204	svhost32.exe
2204	svhost32.exe
2204	svhost32.exe
2204	svhost32.exe
2204	svhost32.exe
2204	svhost32.exe
2204	svhost32.exe
2204	svhost32.exe
2204	svhost32.exe
2204	svhost32.exe
2204	svhost32.exe
2204	svhost32.exe
2204	svhost32.exe
2204	svhost32.exe
2204	svhost32.exe
2204	svhost32.exe
2204	svhost32.exe
2204	svhost32.exe
2204	svhost32.exe
2204	svhost32.exe
2204	svhost32.exe
2204	svhost32.exe
2204	svhost32.exe
2204	svhost32.exe
2204	svhost32.exe
2204	svhost32.exe
2204	svhost32.exe
2204	svhost32.exe
2204	svhost32.exe
2204	svhost32.exe
2204	svhost32.exe
2204	svhost32.exe
2204	svhost32.exe
2204	svhost32.exe
2204	svhost32.exe
2204	svhost32.exe
2204	svhost32.exe
2204	svhost32.exe
2204	svhost32.exe
2204	svhost32.exe
2204	svhost32.exe
2204	svhost32.exe
2204	svhost32.exe
2204	svhost32.exe
2204	svhost32.exe
2204	svhost32.exe
2204	svhost32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2204	svhost32.exe
2204	svhost32.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2148 wrote to memory of 2204	2148	63c457f491126c17dcce5cd5105bc660.exe	28
PID 2148 wrote to memory of 2204	2148	63c457f491126c17dcce5cd5105bc660.exe	28
PID 2148 wrote to memory of 2204	2148	63c457f491126c17dcce5cd5105bc660.exe	28
PID 2148 wrote to memory of 2204	2148	63c457f491126c17dcce5cd5105bc660.exe	28
PID 2148 wrote to memory of 2108	2148	63c457f491126c17dcce5cd5105bc660.exe	29
PID 2148 wrote to memory of 2108	2148	63c457f491126c17dcce5cd5105bc660.exe	29
PID 2148 wrote to memory of 2108	2148	63c457f491126c17dcce5cd5105bc660.exe	29
PID 2148 wrote to memory of 2108	2148	63c457f491126c17dcce5cd5105bc660.exe	29

C:\Users\Admin\AppData\Local\Temp\63c457f491126c17dcce5cd5105bc660.exe
"C:\Users\Admin\AppData\Local\Temp\63c457f491126c17dcce5cd5105bc660.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2148
- C:\Program Files\svhost32.exe
  "C:\Program Files\svhost32.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:2204
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Users\Admin\AppData\Local\Temp\$$c1120.tmp.bat
  2⤵
  - Deletes itself
  PID:2108

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\$$c1120.tmp.bat

Filesize
233B

MD5
1f8f8010dc85ad02196856de199392e5

SHA1
16a980f579a9f91a9be2a93e35da7aa0943c399f

SHA256
c801d99fcea141b755f107f009a4e4404c76d911744b1b9efbd591fca3f0344b

SHA512
959c5a65b88ca46c3dccf7179a956d390ae18450534c5bb1f7b88c4aca7197f18178d153b03624f44aa9ec3f1e09d14c52f387c1f3c842433f14146f9bdc3673

Download Submit
\Program Files\svhost32.exe

Filesize
29KB

MD5
63c457f491126c17dcce5cd5105bc660

SHA1
affbd7c32916a0bf0bb881424b1074dc0c44eb7a

SHA256
9e298f797a9272e30316fc14dada452d0c32988708e96974fabaad3bc834fffd

SHA512
ff2aa41b608f62f161ad41aaad7ea677d6e0b386c7247d64dcdbe4ed1b60523fd75370aec572385ea6f2b50e14b195c141d054ea72294053fdc08678a96b40c0

Download Submit
\Windows\SysWOW64\dllwm.dll

Filesize
32KB

MD5
cabe2b9ebba497c6ccb89ca1d3f7f08c

SHA1
74664143dd330734178216eba39e1d52d2657100

SHA256
ad2fdab1ff8a36840424884b259b4f1dec35196d99043359e0f89684a547cfb9

SHA512
06f9894bad794f5f8d7a777efdac137aab33f8d23832d0910d887a8eb0e8e27b51b9bfa5af31ee91fb832e88cde8197d9411ba9595ef67dd61019ee77f9a8444

Download Submit
memory/2148-0-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/2148-17-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/2148-16-0x0000000000230000-0x0000000000256000-memory.dmp

Filesize
152KB

Download
memory/2204-22-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/2204-20-0x00000000001C0000-0x00000000001CE000-memory.dmp

Filesize
56KB

Download
memory/2204-24-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/2204-25-0x00000000001C0000-0x00000000001CE000-memory.dmp

Filesize
56KB

Download