Analysis
-
max time kernel
86s -
max time network
90s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
27-02-2024 08:35
Behavioral task
behavioral1
Sample
hi.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
hi.exe
Resource
win10v2004-20240226-en
Errors
General
-
Target
hi.exe
-
Size
8.0MB
-
MD5
0643f5e19377fd38e4665c2a6e1f77fa
-
SHA1
f4c4d078731f328ab19757a2ae0ed06010fae71a
-
SHA256
4144b47cf3a8a22d6483dd58820c0f380d975ced0662f392987112f9a83892ac
-
SHA512
daaec710db10671283f8a1b152cbdece3a257c89bffd45bad73fdd5cf160875ee5abc95f9ba351a8e1b4a4fb99360cd81a984e65a5b1a13c7667349a228cb570
-
SSDEEP
196608:GxjTCTDwGcsKgectcGfcY3gtFrlnv/yb4n:Qkk3+eWcGfd85se
Malware Config
Signatures
-
Loads dropped DLL 7 IoCs
Processes:
hi.exepid process 2572 hi.exe 2572 hi.exe 2572 hi.exe 2572 hi.exe 2572 hi.exe 2572 hi.exe 2572 hi.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
hi.exedescription pid process target process PID 2856 wrote to memory of 2572 2856 hi.exe hi.exe PID 2856 wrote to memory of 2572 2856 hi.exe hi.exe PID 2856 wrote to memory of 2572 2856 hi.exe hi.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\hi.exe"C:\Users\Admin\AppData\Local\Temp\hi.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2856 -
C:\Users\Admin\AppData\Local\Temp\hi.exe"C:\Users\Admin\AppData\Local\Temp\hi.exe"2⤵
- Loads dropped DLL
PID:2572
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x01⤵PID:2020
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x11⤵PID:620
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\_MEI28562\api-ms-win-core-file-l1-2-0.dllFilesize
12KB
MD549e3260ae3f973608f4d4701eb97eb95
SHA1097e7d56c3514a3c7dc17a9c54a8782c6d6c0a27
SHA256476fbad616e20312efc943927ade1a830438a6bebb1dd1f83d2370e5343ea7af
SHA512df22cf16490faa0dc809129ca32eaf1a16ec665f9c5411503ce0153270de038e5d3be1e0e49879a67043a688f6c42bdb5a9a6b3cea43bf533eba087e999be653
-
C:\Users\Admin\AppData\Local\Temp\_MEI28562\api-ms-win-core-file-l2-1-0.dllFilesize
12KB
MD57f14fd0436c066a8b40e66386ceb55d0
SHA1288c020fb12a4d8c65ed22a364b5eb8f4126a958
SHA256c78eab8e057bddd55f998e72d8fdf5b53d9e9c8f67c8b404258e198eb2cdcf24
SHA512d04adc52ee0ceed4131eb1d133bfe9a66cbc0f88900270b596116064480afe6ae6ca42feb0eaed54cb141987f2d7716bb2dae947a025014d05d7aa0b0821dc50
-
C:\Users\Admin\AppData\Local\Temp\_MEI28562\api-ms-win-core-localization-l1-2-0.dllFilesize
15KB
MD571457fd15de9e0b3ad83b4656cad2870
SHA1c9c2caf4f9e87d32a93a52508561b4595617f09f
SHA256db970725b36cc78ef2e756ff4b42db7b5b771bfd9d106486322cf037115bd911
SHA512a10fcf1d7637effff0ae3e3b4291d54cc7444d985491e82b3f4e559fbb0dbb3b6231a8c689ff240a5036a7acae47421cda58aaa6938374d4b84893cce0077bc8
-
C:\Users\Admin\AppData\Local\Temp\_MEI28562\api-ms-win-core-processthreads-l1-1-1.dllFilesize
13KB
MD5e93816c04327730d41224e7a1ba6dc51
SHA13f83b9fc6291146e58afce5b5447cd6d2f32f749
SHA256ca06ccf12927ca52d8827b3a36b23b6389c4c6d4706345e2d70b895b79ff2ec8
SHA512beaab5a12bfc4498cdf67d8b560ef0b0e2451c5f4634b6c5780a857666fd14f8a379f42e38be1beefa1c3578b2df913d901b271719ac6794bfaab0731bb77bca
-
C:\Users\Admin\AppData\Local\Temp\_MEI28562\api-ms-win-core-timezone-l1-1-0.dllFilesize
13KB
MD5acf40d5e6799231cf7e4026bad0c50a0
SHA18f0395b7e7d2aac02130f47b23b50d1eab87466b
SHA25664b5b95fe56b6df4c2d47d771bec32bd89267605df736e08c1249b802d6d48d1
SHA512f66a61e89231b6dc95b26d97f5647da42400bc809f70789b9afc00a42b94ea3487913860b69a1b0ee59ed5eb62c3a0cade9e21f95da35fdd42d8ce51c5507632
-
C:\Users\Admin\AppData\Local\Temp\_MEI28562\python311.dllFilesize
5.5MB
MD558e01abc9c9b5c885635180ed104fe95
SHA11c2f7216b125539d63bd111a7aba615c69deb8ba
SHA256de1b95d2e951fc048c84684bc7df4346138910544ee335b61fc8e65f360c3837
SHA512cd32c77191309d99aeed47699501b357b35669123f0dd70ed97c3791a009d1855ab27162db24a4bd9e719b68ee3b0539ee6db88e71abb9a2d4d629f87bc2c081
-
C:\Users\Admin\AppData\Local\Temp\_MEI28562\ucrtbase.dllFilesize
994KB
MD58e7680a8d07c3c4159241d31caaf369c
SHA162fe2d4ae788ee3d19e041d81696555a6262f575
SHA25636cc22d92a60e57dee394f56a9d1ed1655ee9db89d2244a959005116a4184d80
SHA5129509f5b07588a08a490f4c3cb859bbfe670052c1c83f92b9c3356afa664cb500364e09f9dafac7d387332cc52d9bb7bb84ceb1493f72d4d17ef08b9ee3cb4174
-
memory/620-112-0x00000000026E0000-0x00000000026E1000-memory.dmpFilesize
4KB
-
memory/2020-111-0x00000000029C0000-0x00000000029C1000-memory.dmpFilesize
4KB