99fcfa72a4c12834c344d89a1db6a708e356cd0bf7d80fec62e7113c84ebead7

Resubmissions

15/06/2026, 01:28

260615-bv4kasgv4x

10/06/2026, 07:32

21/04/2026, 03:57

26/02/2026, 11:07

20/10/2025, 19:02

23/02/2024, 14:33

Analysis

max time kernel
145s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
23/02/2024, 14:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1- Hosts blocker/EaseUS hosts blocker.bat
Size 3KB
Sample240223-rw7aksbb35
SHA256 0124f42ac03a8f0ccacb35cf2e57d8ce96a323d66fbe4ebe06ad1def2e4d3b20
MD5 a20bef352c605997b09e2da7bca1f16e
SHA1 732df89434737131afb0ebaa94bbdafee76181af
SHA512 4951e502b532506c7071ca014f2e08fb60731c877ce07af4903433074f710ccce8887e39efb2f5ef7456b206947f3457fc16405c9a4048d53470b7d0c4d620d5
MD5 SHA1 SHA512

Score

8^/10

discovery

Malware Config

Signatures

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	attrib.exe
File opened for modification	C:\Windows\system32\drivers\etc\hosts	cmd.exe

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
956	icacls.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
1700	ipconfig.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 652 wrote to memory of 4568	652	cmd.exe	86
PID 652 wrote to memory of 4568	652	cmd.exe	86
PID 652 wrote to memory of 956	652	cmd.exe	87
PID 652 wrote to memory of 956	652	cmd.exe	87
PID 652 wrote to memory of 3524	652	cmd.exe	88
PID 652 wrote to memory of 3524	652	cmd.exe	88
PID 652 wrote to memory of 1472	652	cmd.exe	89
PID 652 wrote to memory of 1472	652	cmd.exe	89
PID 652 wrote to memory of 4744	652	cmd.exe	90
PID 652 wrote to memory of 4744	652	cmd.exe	90
PID 652 wrote to memory of 1596	652	cmd.exe	91
PID 652 wrote to memory of 1596	652	cmd.exe	91
PID 652 wrote to memory of 2324	652	cmd.exe	92
PID 652 wrote to memory of 2324	652	cmd.exe	92
PID 652 wrote to memory of 2336	652	cmd.exe	93
PID 652 wrote to memory of 2336	652	cmd.exe	93
PID 652 wrote to memory of 3996	652	cmd.exe	94
PID 652 wrote to memory of 3996	652	cmd.exe	94
PID 652 wrote to memory of 1236	652	cmd.exe	95
PID 652 wrote to memory of 1236	652	cmd.exe	95
PID 652 wrote to memory of 4552	652	cmd.exe	96
PID 652 wrote to memory of 4552	652	cmd.exe	96
PID 652 wrote to memory of 1428	652	cmd.exe	97
PID 652 wrote to memory of 1428	652	cmd.exe	97
PID 652 wrote to memory of 4268	652	cmd.exe	98
PID 652 wrote to memory of 4268	652	cmd.exe	98
PID 652 wrote to memory of 3204	652	cmd.exe	100
PID 652 wrote to memory of 3204	652	cmd.exe	100
PID 652 wrote to memory of 2832	652	cmd.exe	101
PID 652 wrote to memory of 2832	652	cmd.exe	101
PID 652 wrote to memory of 3484	652	cmd.exe	102
PID 652 wrote to memory of 3484	652	cmd.exe	102
PID 652 wrote to memory of 4728	652	cmd.exe	103
PID 652 wrote to memory of 4728	652	cmd.exe	103
PID 652 wrote to memory of 1608	652	cmd.exe	104
PID 652 wrote to memory of 1608	652	cmd.exe	104
PID 652 wrote to memory of 4196	652	cmd.exe	105
PID 652 wrote to memory of 4196	652	cmd.exe	105
PID 652 wrote to memory of 3520	652	cmd.exe	106
PID 652 wrote to memory of 3520	652	cmd.exe	106
PID 652 wrote to memory of 1700	652	cmd.exe	108
PID 652 wrote to memory of 1700	652	cmd.exe	108

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
3524	attrib.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1- Hosts blocker\EaseUS hosts blocker.bat"
1⤵
- Drops file in Drivers directory
- Suspicious use of WriteProcessMemory
PID:652
- C:\Windows\system32\fltMC.exe
  fltmc
  2⤵
  PID:4568
- C:\Windows\system32\icacls.exe
  icacls "C:\Windows\System32\drivers\etc\hosts" /grant administrators:F
  2⤵
  - Modifies file permissions
  PID:956
- C:\Windows\system32\attrib.exe
  attrib -h -r -s "C:\Windows\System32\drivers\etc\hosts"
  2⤵
  - Drops file in Drivers directory
  - Views/modifies file attributes
  PID:3524
- C:\Windows\system32\find.exe
  FIND /C /I "easeus.com" C:\Windows\system32\drivers\etc\hosts
  2⤵
  PID:1472
- C:\Windows\system32\find.exe
  FIND /C /I "www.easeus.com" C:\Windows\system32\drivers\etc\hosts
  2⤵
  PID:4744
- C:\Windows\system32\find.exe
  FIND /C /I "activation.easeus.com" C:\Windows\system32\drivers\etc\hosts
  2⤵
  PID:1596
- C:\Windows\system32\find.exe
  FIND /C /I "easeus.com.cn" C:\Windows\system32\drivers\etc\hosts
  2⤵
  PID:2324
- C:\Windows\system32\find.exe
  FIND /C /I "www.easeus.com.cn" C:\Windows\system32\drivers\etc\hosts
  2⤵
  PID:2336
- C:\Windows\system32\find.exe
  FIND /C /I "track.easeus.com" C:\Windows\system32\drivers\etc\hosts
  2⤵
  PID:3996
- C:\Windows\system32\find.exe
  FIND /C /I "track.easeus.com.cn" C:\Windows\system32\drivers\etc\hosts
  2⤵
  PID:1236
- C:\Windows\system32\find.exe
  FIND /C /I "api.easeus.com" C:\Windows\system32\drivers\etc\hosts
  2⤵
  PID:4552
- C:\Windows\system32\find.exe
  FIND /C /I "update.easeus.com" C:\Windows\system32\drivers\etc\hosts
  2⤵
  PID:1428
- C:\Windows\system32\find.exe
  FIND /C /I "map2.hwcdn.net" C:\Windows\system32\drivers\etc\hosts
  2⤵
  PID:4268
- C:\Windows\system32\find.exe
  FIND /C /I "easeusinfo.us-east-1.log.aliyuncs.com" C:\Windows\system32\drivers\etc\hosts
  2⤵
  PID:3204
- C:\Windows\system32\find.exe
  FIND /C /I "aaa100cd68bbe03f3.awsglobalaccelerator.com" C:\Windows\system32\drivers\etc\hosts
  2⤵
  PID:2832
- C:\Windows\system32\find.exe
  FIND /C /I "uompro.easeus.com" C:\Windows\system32\drivers\etc\hosts
  2⤵
  PID:3484
- C:\Windows\system32\find.exe
  FIND /C /I "order.easeus.com" C:\Windows\system32\drivers\etc\hosts
  2⤵
  PID:4728
- C:\Windows\system32\find.exe
  FIND /C /I "curl.haxx.se" C:\Windows\system32\drivers\etc\hosts
  2⤵
  PID:1608
- C:\Windows\system32\find.exe
  FIND /C /I "buy.easeus.com" C:\Windows\system32\drivers\etc\hosts
  2⤵
  PID:4196
- C:\Windows\system32\find.exe
  FIND /C /I "v2api-uoss.easeus.com" C:\Windows\system32\drivers\etc\hosts
  2⤵
  PID:3520
- C:\Windows\system32\ipconfig.exe
  ipconfig /flushdns
  2⤵
  - Gathers network information
  PID:1700

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 1KB
SHA256 e3b5004c5fdacd8622c4f5f4ea58e7bece06511dd284017ff4f7e7316a78c9ff
MD5 8e9032a3eb7a37cd795e1a9e0655327b
SHA1 c97a6c214ec24b65c30dd68df023dbc1297094ba
SHA512 7b9660fa6df014fdb0f5bdcd8c5149e862f9c5932766f41bc5f3b74b753a38ca2d30d022a72a1c1f8d6a1043c5049ffd2134fb457da5d39e921231db1c276777
MD5 SHA1 SHA512

Submit Download

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 1KB
SHA256 738f4f0d4aff947cb21a5c633adcb4a645e59548946169e1bfb90dbe5df54e2b
MD5 c83061c3b0686c9ba293a781b0bac6e9
SHA1 225debd27fa29b4acd9e531a57681c58b0e8a91f
SHA512 3fa4987756976c3134e55157387f83d99242d8fc3397d201c2b7fa75519e90bf7a3ad05814bca1d6fa9885cfcf167e7de4cb7c14e98e779a2d166bf7345732ae
MD5 SHA1 SHA512

Submit Download

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 1KB
SHA256 89605f10d048157455e49df22213e250e09c80258bb502af4b81946005248e39
MD5 a4f9c79d899a7fd21d0fd1aadf5ccc84
SHA1 f58741f77d5b8eba650a77a4d3be3771870c26b0
SHA512 8ceff05a145573dbe185d2b424a23008946260e319c25a149de65146e6ee095616e8712a9b673bd6de11e3d19b367f4e5c32cb1af1e281b13a2f780c66f91ada
MD5 SHA1 SHA512

Submit Download

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 1KB
SHA256 671c94e196d561b943e2a55977b63fe7008fdca178e65c86d4ea230f83e2c536
MD5 7bb81ab34c3178e691b4b22321cbe4c6
SHA1 d2bc2241a195d6bd43b10d0b7a899120f7437f9c
SHA512 85523569e5408568d68d52980b650b696b6376985c488c97425215109cb3c7682971a244d5c01b3b307c47dc17a2d88036d42e342760f4d8845f6d4a5e79e196
MD5 SHA1 SHA512

Submit Download

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 1KB
SHA256 d603e9237c543f02ef5c1c743b84b656473d980045e8834bb79c781a00f39e4c
MD5 a6ad4d28f52e56fd0c549629354886c9
SHA1 f5dec7486f1a189707d194954d97edafecb8f2ec
SHA512 24f4d4c7ec314ae306ac853851e298d84f1ce768923913ddf59b77b4971b50f7e46c00f497d2cb2b2b800d8ef97b7ffbe7ecc8b9af8c1e5685ec5dd938a2b04b
MD5 SHA1 SHA512

Submit Download

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 1KB
SHA256 49016f362ff411a2b25beeecdb985fb067ee049e8f127461965fb2dbcd572e7d
MD5 0847929495330e2911c1470846d4ccc9
SHA1 2d1cb9d1a69ae6e6a219e23b1014b3466990e27e
SHA512 adf4579ed1b24e00fce05113dc9cd1ee43f1cf863d4d3209a2bd05f292ff41d8d3071f91a4ac21c3710fa579a97ecb9d93fbd5f3f9d814e7d7c821e8b677b130
MD5 SHA1 SHA512

Submit Download

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 1KB
SHA256 0628e01b3139d728fc0accc5ec5286b28c6fadbc1d789349380fd9b702ef88fc
MD5 8425cfb8788bc09ace02bd800801b7ad
SHA1 195e4a03418b8c4a8dab49a9de06740eb88437a2
SHA512 0bf2d242715abccd1732b2c6b129dec4fa4c8e66f676e64bda7f2249f786bb0d3877b97799239ba9e4b82594150c5ad6ebdc50dc83df983c16015cc715e55e76
MD5 SHA1 SHA512

Submit Download

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 1KB
SHA256 bf8017095191f0ec101bc0d329cf1fd1062eea34c4517b4bebc7bb04fe269f69
MD5 505fd449ae8d2c900e5911fd43f8f319
SHA1 c0ab5c63f3a50fee3a38e198cd8db290e2f90de2
SHA512 715cf966543707735cc3931f8553933c2cf97f348ecdea62fcc3771e2c14c58a4b9b6bd51bf2649bbb7f9841ea38d07b970a44ab0c6d7ff72c4e34e5ecaced75
MD5 SHA1 SHA512

Submit Download

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 1KB
SHA256 1a3c168f5d1c6c00a557ce4817eb9fed3827a6ff9a220a48f3f1923a7ca5171f
MD5 89a3f3f506f9da4142fd1baa1540910b
SHA1 46589e59d687e9174339fdeb67cb76a880d35af8
SHA512 e644011c07cc2acd01d59ec8dc19a12b7da8ae65f08e47de6ba487ac0a7246366340f16c40dff7cb72d9af664df31e64e269d0b7050f71e6e45f7b47e05f451e
MD5 SHA1 SHA512

Submit Download

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 1KB
SHA256 b89bd149edda8089526de0927b4a354f7e056845ff32ee305051ac1ecd006570
MD5 af672ef2ca8e7e456e463f977a861516
SHA1 03781924d1ea33f85d7cc71231a18664b0283f03
SHA512 df08b0cb992e10caf9e4db28d7a54252dab26297e79613ed55d7bb87155d401e65ce09c9ccaff6303f2e710501161f8f7b9d321b41be58d7ebb65a049ba3ed5a
MD5 SHA1 SHA512

Submit Download

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 1KB
SHA256 52860d243f17e6769c63e8efe6912aaa6ddc794ccc2bb7b091c63c19e56ed540
MD5 b8915117ea85ac72d2b069b42de9fcc0
SHA1 9ccf1d242774389bf25d23f7264e6171b4d4183f
SHA512 f8e84ce93019ee0c9817c39ddb3ba02aeb0ef74fb315c9a3d06da040410517261c186b3aaae450b1aecbdac765230349477f08c57aded9a8283cf1da7ecf4204
MD5 SHA1 SHA512

Submit Download

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 1KB
SHA256 9130c74b3a48eec18b195cafde47ef8ab80a64781cb3f1f5e04b95419def13e5
MD5 a70cf32205bc01a104c14c820b6d6dde
SHA1 da9a22dd14089406da593e92c52a24a391fcfe20
SHA512 90b6349dad100ee6097f0487085012f601e222782af5e153423f1eae00b3f0f72402f8dd9299719ef6dd22a27303e1ab9f63e325775846aa9e7260e59e7ec0fa
MD5 SHA1 SHA512

Submit Download

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 1KB
SHA256 68fb84135c4963a5496ce06771832266e017c7d3191be649cd3b7fd67ae12c21
MD5 425d21bc38b7a4dec7210549339fdbd7
SHA1 c277b94c6152729668e2087c0e2cceb62d5c0b1b
SHA512 2eb1f6f98ba085a0ee500ef3916fdfb3d0e9f48755230c9aa9fc30bad6d5d05c2d531c55c7589676728591975f91581739618e2e9199d484dfc02365c6fce508
MD5 SHA1 SHA512

Submit Download

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 1KB
SHA256 afbd476b89e2e1f7ae8842862172e6c5d3233a61fd3e60be82805bdc459cc64b
MD5 a2f62c6769001ac5bc6137d9c25ef68c
SHA1 1f5a39c2e12cc3c93caaea0a6ce252c2e1033bbe
SHA512 5d7b1b4d131fb15fadbf88278146e294e2dfbba71b53001f3a60762592a892e227dab23dd4b77104d4f7984a1aeff4f2a8d6734362a4f8874bb17e1ddc67ec3a
MD5 SHA1 SHA512

Submit Download

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 1KB
SHA256 b544a138bda9a924070dfa845104ca79fa4dd4ca3366717b878915db14735770
MD5 7a5470d0e5b81c843dcc292c96db73b7
SHA1 1709f7b5d7f3bf3dd0fbf319df8f7fbaac0363ec
SHA512 8954630893e4f309b60c870d717ab5d7be5aab89fd75f80999a5c0f22b57b97d6553739534af421a4ffeee0b29ee58da269a1184ee219462ec52da236b658b23
MD5 SHA1 SHA512

Submit Download

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 1KB
SHA256 b5c550655073010b5c2adda543af94a4962b31f3f329c49f900cf3cf379ba6ed
MD5 c48c9c57ed9a5d1b5755950349504e81
SHA1 baa374770db4d04f44ab8b96bccb05fdf11f23ef
SHA512 2bfcef0f1b48a2857c774a00ff62332cc6e68f04f262e174f909c3afd17078301c9e617cd8de5746735005551d279f377c4ff052ff835479d9a2bf488c1d37d7
MD5 SHA1 SHA512

Submit Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads