Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
25/01/2024, 00:36
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
7345a893a6540bb9f630ca1ca2e4fcc5.exe
Resource
win7-20231215-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
7345a893a6540bb9f630ca1ca2e4fcc5.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
4 signatures
150 seconds
General
-
Target
7345a893a6540bb9f630ca1ca2e4fcc5.exe
-
Size
216KB
-
MD5
7345a893a6540bb9f630ca1ca2e4fcc5
-
SHA1
57decee1c23a1e64c5865975ee131a7f4c0d34b8
-
SHA256
d509ad1e3af77819913ce6b3477835e8e6f48c397455f4367eb8707edb5220a7
-
SHA512
d9db73be827f120bc1e701b3b2b7e6a0ed594a329fd6d83b3d5d2ed9e4fbc5b43609f337f8c2685f37e5069c5c645242d87e56a2f389aff1c814f0716c4d63c3
-
SSDEEP
6144:QGfPegP5Sl5lHEiWjvjfxOtGLCBXaaf52f:JP1SlLX6vjl3
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 6 IoCs
pid Process 2872 KERNEL211.EXE 1268 KERNEL211.EXE 2880 KERNEL211.EXE 2832 KERNEL211.EXE 4704 KERNEL211.EXE 3296 KERNEL211.EXE -
Drops file in System32 directory 8 IoCs
description ioc Process File created C:\Windows\SysWOW64\KERNEL211.EXE KERNEL211.EXE File created C:\Windows\SysWOW64\KERNEL211.EXE KERNEL211.EXE File created C:\Windows\SysWOW64\KERNEL211.EXE 7345a893a6540bb9f630ca1ca2e4fcc5.exe File opened for modification C:\Windows\SysWOW64\KERNEL211.EXE 7345a893a6540bb9f630ca1ca2e4fcc5.exe File created C:\Windows\SysWOW64\KERNEL211.EXE KERNEL211.EXE File created C:\Windows\SysWOW64\KERNEL211.EXE KERNEL211.EXE File created C:\Windows\SysWOW64\KERNEL211.EXE KERNEL211.EXE File created C:\Windows\SysWOW64\KERNEL211.EXE KERNEL211.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1548 7345a893a6540bb9f630ca1ca2e4fcc5.exe 1548 7345a893a6540bb9f630ca1ca2e4fcc5.exe 1548 7345a893a6540bb9f630ca1ca2e4fcc5.exe 1548 7345a893a6540bb9f630ca1ca2e4fcc5.exe 1548 7345a893a6540bb9f630ca1ca2e4fcc5.exe 1548 7345a893a6540bb9f630ca1ca2e4fcc5.exe 1548 7345a893a6540bb9f630ca1ca2e4fcc5.exe 1548 7345a893a6540bb9f630ca1ca2e4fcc5.exe 1548 7345a893a6540bb9f630ca1ca2e4fcc5.exe 1548 7345a893a6540bb9f630ca1ca2e4fcc5.exe 1548 7345a893a6540bb9f630ca1ca2e4fcc5.exe 1548 7345a893a6540bb9f630ca1ca2e4fcc5.exe 1548 7345a893a6540bb9f630ca1ca2e4fcc5.exe 1548 7345a893a6540bb9f630ca1ca2e4fcc5.exe 2872 KERNEL211.EXE 2872 KERNEL211.EXE 2872 KERNEL211.EXE 2872 KERNEL211.EXE 2872 KERNEL211.EXE 2872 KERNEL211.EXE 2872 KERNEL211.EXE 2872 KERNEL211.EXE 2872 KERNEL211.EXE 2872 KERNEL211.EXE 2872 KERNEL211.EXE 2872 KERNEL211.EXE 2872 KERNEL211.EXE 2872 KERNEL211.EXE 1268 KERNEL211.EXE 1268 KERNEL211.EXE 1268 KERNEL211.EXE 1268 KERNEL211.EXE 1268 KERNEL211.EXE 1268 KERNEL211.EXE 1268 KERNEL211.EXE 1268 KERNEL211.EXE 1268 KERNEL211.EXE 1268 KERNEL211.EXE 1268 KERNEL211.EXE 1268 KERNEL211.EXE 1268 KERNEL211.EXE 1268 KERNEL211.EXE 1268 KERNEL211.EXE 1268 KERNEL211.EXE 2880 KERNEL211.EXE 2880 KERNEL211.EXE 2880 KERNEL211.EXE 2880 KERNEL211.EXE 2880 KERNEL211.EXE 2880 KERNEL211.EXE 2880 KERNEL211.EXE 2880 KERNEL211.EXE 2880 KERNEL211.EXE 2880 KERNEL211.EXE 2880 KERNEL211.EXE 2880 KERNEL211.EXE 2880 KERNEL211.EXE 2880 KERNEL211.EXE 2832 KERNEL211.EXE 2832 KERNEL211.EXE 2832 KERNEL211.EXE 2832 KERNEL211.EXE 2832 KERNEL211.EXE 2832 KERNEL211.EXE -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 1548 wrote to memory of 2872 1548 7345a893a6540bb9f630ca1ca2e4fcc5.exe 89 PID 1548 wrote to memory of 2872 1548 7345a893a6540bb9f630ca1ca2e4fcc5.exe 89 PID 1548 wrote to memory of 2872 1548 7345a893a6540bb9f630ca1ca2e4fcc5.exe 89 PID 2872 wrote to memory of 1268 2872 KERNEL211.EXE 98 PID 2872 wrote to memory of 1268 2872 KERNEL211.EXE 98 PID 2872 wrote to memory of 1268 2872 KERNEL211.EXE 98 PID 1268 wrote to memory of 2880 1268 KERNEL211.EXE 100 PID 1268 wrote to memory of 2880 1268 KERNEL211.EXE 100 PID 1268 wrote to memory of 2880 1268 KERNEL211.EXE 100 PID 2880 wrote to memory of 2832 2880 KERNEL211.EXE 101 PID 2880 wrote to memory of 2832 2880 KERNEL211.EXE 101 PID 2880 wrote to memory of 2832 2880 KERNEL211.EXE 101 PID 2832 wrote to memory of 4704 2832 KERNEL211.EXE 102 PID 2832 wrote to memory of 4704 2832 KERNEL211.EXE 102 PID 2832 wrote to memory of 4704 2832 KERNEL211.EXE 102 PID 4704 wrote to memory of 3296 4704 KERNEL211.EXE 103 PID 4704 wrote to memory of 3296 4704 KERNEL211.EXE 103 PID 4704 wrote to memory of 3296 4704 KERNEL211.EXE 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\7345a893a6540bb9f630ca1ca2e4fcc5.exe"C:\Users\Admin\AppData\Local\Temp\7345a893a6540bb9f630ca1ca2e4fcc5.exe"1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1548 -
C:\Windows\SysWOW64\KERNEL211.EXEC:\Windows\system32\KERNEL211.EXE2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2872 -
C:\Windows\SysWOW64\KERNEL211.EXEC:\Windows\system32\KERNEL211.EXE3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1268 -
C:\Windows\SysWOW64\KERNEL211.EXEC:\Windows\system32\KERNEL211.EXE4⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2880 -
C:\Windows\SysWOW64\KERNEL211.EXEC:\Windows\system32\KERNEL211.EXE5⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2832 -
C:\Windows\SysWOW64\KERNEL211.EXEC:\Windows\system32\KERNEL211.EXE6⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4704 -
C:\Windows\SysWOW64\KERNEL211.EXEC:\Windows\system32\KERNEL211.EXE7⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3296
-
-
-
-
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
216KB
MD57345a893a6540bb9f630ca1ca2e4fcc5
SHA157decee1c23a1e64c5865975ee131a7f4c0d34b8
SHA256d509ad1e3af77819913ce6b3477835e8e6f48c397455f4367eb8707edb5220a7
SHA512d9db73be827f120bc1e701b3b2b7e6a0ed594a329fd6d83b3d5d2ed9e4fbc5b43609f337f8c2685f37e5069c5c645242d87e56a2f389aff1c814f0716c4d63c3