e115f249d6fff61de3d44a6e59c4ef2f692a9f28db480c9a83737d1f90fe48d7

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
19-01-2024 04:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9b6be74c2c144f8bcb92c8350855d35c14bb7f2b727551c3dd5c8054c4136e3f.exe
Size

10.4MB
MD5

00c69252bc0e896e2a8b0a9a3d68e41e
SHA1

37d01981b79ac2e397ef7264d6dcf568634c01c7
SHA256

9b6be74c2c144f8bcb92c8350855d35c14bb7f2b727551c3dd5c8054c4136e3f
SHA512

a7701f865063cf73c2fe57265931f9177b69f34599903204cae4cc7f59de22de07bc0880f0274fc8663b4b772478fdd7b677e9f7beb37733ad8a63037157f7c2
SSDEEP

196608:pINtwZV9xnc45SyY+GOe42yOmL2Vmd6+D/2c/f/+SHSEqEEQ+Knm/Z1y:otS9xnnSyY+k4tOmL2Vmd6m+c/eFR4C1

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 7 IoCs

Processes:

9b6be74c2c144f8bcb92c8350855d35c14bb7f2b727551c3dd5c8054c4136e3f.exe

pid	process
2612	9b6be74c2c144f8bcb92c8350855d35c14bb7f2b727551c3dd5c8054c4136e3f.exe
2612	9b6be74c2c144f8bcb92c8350855d35c14bb7f2b727551c3dd5c8054c4136e3f.exe
2612	9b6be74c2c144f8bcb92c8350855d35c14bb7f2b727551c3dd5c8054c4136e3f.exe
2612	9b6be74c2c144f8bcb92c8350855d35c14bb7f2b727551c3dd5c8054c4136e3f.exe
2612	9b6be74c2c144f8bcb92c8350855d35c14bb7f2b727551c3dd5c8054c4136e3f.exe
2612	9b6be74c2c144f8bcb92c8350855d35c14bb7f2b727551c3dd5c8054c4136e3f.exe
2612	9b6be74c2c144f8bcb92c8350855d35c14bb7f2b727551c3dd5c8054c4136e3f.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

9b6be74c2c144f8bcb92c8350855d35c14bb7f2b727551c3dd5c8054c4136e3f.exe

description	pid	process	target process
PID 2228 wrote to memory of 2612	2228	9b6be74c2c144f8bcb92c8350855d35c14bb7f2b727551c3dd5c8054c4136e3f.exe	9b6be74c2c144f8bcb92c8350855d35c14bb7f2b727551c3dd5c8054c4136e3f.exe
PID 2228 wrote to memory of 2612	2228	9b6be74c2c144f8bcb92c8350855d35c14bb7f2b727551c3dd5c8054c4136e3f.exe	9b6be74c2c144f8bcb92c8350855d35c14bb7f2b727551c3dd5c8054c4136e3f.exe
PID 2228 wrote to memory of 2612	2228	9b6be74c2c144f8bcb92c8350855d35c14bb7f2b727551c3dd5c8054c4136e3f.exe	9b6be74c2c144f8bcb92c8350855d35c14bb7f2b727551c3dd5c8054c4136e3f.exe

C:\Users\Admin\AppData\Local\Temp\9b6be74c2c144f8bcb92c8350855d35c14bb7f2b727551c3dd5c8054c4136e3f.exe
"C:\Users\Admin\AppData\Local\Temp\9b6be74c2c144f8bcb92c8350855d35c14bb7f2b727551c3dd5c8054c4136e3f.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2228

C:\Users\Admin\AppData\Local\Temp\9b6be74c2c144f8bcb92c8350855d35c14bb7f2b727551c3dd5c8054c4136e3f.exe
"C:\Users\Admin\AppData\Local\Temp\9b6be74c2c144f8bcb92c8350855d35c14bb7f2b727551c3dd5c8054c4136e3f.exe"
2⤵
- Loads dropped DLL
PID:2612

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_MEI22282\api-ms-win-core-file-l2-1-0.dll
Filesize
18KB

MD5
bfffa7117fd9b1622c66d949bac3f1d7

SHA1
402b7b8f8dcfd321b1d12fc85a1ee5137a5569b2

SHA256
1ea267a2e6284f17dd548c6f2285e19f7edb15d6e737a55391140ce5cb95225e

SHA512
b319cc7b436b1be165cdf6ffcab8a87fe29de78f7e0b14c8f562be160481fb5483289bd5956fdc1d8660da7a3f86d8eede35c6cc2b7c3d4c852decf4b2dcdb7f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI22282\api-ms-win-core-localization-l1-2-0.dll
Filesize
20KB

MD5
588bd2a8e0152e0918742c1a69038f1d

SHA1
9874398548891f6a08fc06437996f84eb7495783

SHA256
a07cc878ab5595aacd4ab229a6794513f897bd7ad14bcec353793379146b2094

SHA512
32ffe64c697f94c4db641ab3e20b0f522cf3eba9863164f1f6271d2f32529250292a16be95f32d852480bd1b59b8b0554c1e7fd7c7a336f56c048f4f56e4d62f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI22282\api-ms-win-core-processthreads-l1-1-1.dll
Filesize
18KB

MD5
d699333637db92d319661286df7cc39e

SHA1
0bffb9ed366853e7019452644d26e8e8f236241b

SHA256
fe760614903e6d46a1be508dccb65cf6929d792a1db2c365fc937f2a8a240504

SHA512
6fa9ff0e45f803faf3eb9908e810a492f6f971cb96d58c06f408980ab40cba138b52d853aa0e3c68474053690dfafa1817f4b4c8fb728d613696b6c516fa0f51

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI22282\python310.dll
Filesize
64KB

MD5
f5cbe1279ea9e1f197ecdd97640d843c

SHA1
ea0b4e179ff74dc9aeb5b97c026bf76291c0be40

SHA256
f915d395d5ec9f2c02929426c06f8f2662137632ed8a859bf32567853d1f1df1

SHA512
8b666c9653d39be4511daad3299386c11c28f6642a0a7b0f1caecd70c5c1b671801f51731d76d9cd9566e56ac4f915c40f83ce7d23b4bd9504fd49b1a2c4f796

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI22282\ucrtbase.dll
Filesize
192KB

MD5
51eb725355b1f66fafdaf7f76c221c8b

SHA1
6af9a2dffa9f65902d083f60f1d92c3ea0034595

SHA256
dfcdbccba716c0f9c642491df91b7d1fb94369cf0347b87f03cff709f95e725d

SHA512
2a3eab122c06bcf19b6b36f458b4ad1f1be86bf418ed3dbd92dac3e65bcd5978dbf1b96b26d4e665de675918591de3c6f2a7f87be0f76018e82fceb7186df780

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI22282\api-ms-win-core-file-l1-2-0.dll
Filesize
18KB

MD5
49c3ffd47257dbcb67a6be9ee112ba7f

SHA1
04669214375b25e2dc8a3635484e6eeb206bc4eb

SHA256
322d963d2a2aefd784e99697c59d494853d69bed8efd4b445f59292930a6b165

SHA512
bda5e6c669b04aaed89538a982ef430cef389237c6c1d670819a22b2a20bf3c22aef5cb4e73ef7837cbbd89d870693899f97cb538122059c885f4b19b7860a98

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI22282\api-ms-win-core-timezone-l1-1-0.dll
Filesize
18KB

MD5
f62b66f451f2daa8410ad62d453fa0a2

SHA1
4bf13db65943e708690d6256d7ddd421cc1cc72b

SHA256
48eb5b52227b6fb5be70cb34009c8da68356b62f3e707db56af957338ba82720

SHA512
d64c2a72adf40bd451341552e7e6958779de3054b0cf676b876c3ba7b86147aecba051ac08adc0c3bfb2779109f87dca706c43de3ce36e05af0ddee02bbbf419

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI22282\python310.dll
Filesize
4.3MB

MD5
c80b5cb43e5fe7948c3562c1fff1254e

SHA1
f73cb1fb9445c96ecd56b984a1822e502e71ab9d

SHA256
058925e4bbfcb460a3c00ec824b8390583baef0c780a7c7ff01d43d9eec45f20

SHA512
faa97a9d5d2a0bf78123f19f8657c24921b907268938c26f79e1df6d667f7bee564259a3a11022e8629996406cda9fa00434bb2b1de3e10b9bddc59708dbad81

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI22282\ucrtbase.dll
Filesize
799KB

MD5
73564b526f0b842c84f42a11ce9f5e7c

SHA1
85a23da50620f86e5e38860706ef557fc20b0cfb

SHA256
bbfcb39858e495e3e8dd49456654ed7b78a2750e37fb7a605beb9b665278b15a

SHA512
36c0868ef762cae10276fcd9e780552015f81d593a54231a1b335a8076c8f9e7055cbcc964ae53e1a834311dc66bb6b75932b6cc2b974557e4deb9c3b5882c5e

Download Submit