Analysis

  • max time kernel
    151s
  • max time network
    132s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    28-02-2024 01:47

General

  • Target

    e36cb720d65332ede19b931c078296472dfad9e593a16005f18298eebec450dc.exe

  • Size

    166.6MB

  • MD5

    909b8ff542a9f0d3b1a76ba0fa5f036b

  • SHA1

    5b65415a26d06022622521311a69d46b2baed898

  • SHA256

    e36cb720d65332ede19b931c078296472dfad9e593a16005f18298eebec450dc

  • SHA512

    6554d104763b1270c48301308a5c85d402bba6054536e58f8f2be20672b7c2f5bd6355a14754b8728777dfeb3e72fb58e0d073ef280b3f16241531a1baeacd74

  • SSDEEP

    1572864:hytl8IZ6lU/gmq2tuB+chCE9BQs/vvKMz5etQzI:onZ6O/gmrYB+ch/9l/3KMz5etQU

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e36cb720d65332ede19b931c078296472dfad9e593a16005f18298eebec450dc.exe
    "C:\Users\Admin\AppData\Local\Temp\e36cb720d65332ede19b931c078296472dfad9e593a16005f18298eebec450dc.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:1212

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\.net\e36cb720d65332ede19b931c078296472dfad9e593a16005f18298eebec450dc\sqvgNfBSELMWQALuqeKShgkshhFO5Us=\clrcompression.dll

    Filesize

    753KB

    MD5

    2796467ae763a705b2ef39ea66647716

    SHA1

    d83c3b872d5834e8c8bb2b7b5ed7f7858efc7d7d

    SHA256

    b0ee0e2f69a772001e65830ef106db8563943e69a5684fddd4a9135b3fec0760

    SHA512

    06302947e2681018a0e66efcaa73052ea24c488e228d2775273f6c32efbcb8758c0ada3e60afcce3dcb2e5cd0e3b817d878b91150dca44d644611624dfb4001a

  • \Users\Admin\AppData\Local\Temp\.net\e36cb720d65332ede19b931c078296472dfad9e593a16005f18298eebec450dc\sqvgNfBSELMWQALuqeKShgkshhFO5Us=\clrjit.dll

    Filesize

    1.2MB

    MD5

    b2eb7b51bd58201cf498e83846e90110

    SHA1

    ca439759b5c5162e626d2b84ab55b93adc552e06

    SHA256

    180557694842854789457a872df849b2130098a9c2bfd70d201f77bec6f9fddb

    SHA512

    1a92064b3417b287246fadd88fea9138dfcc659283e063aab9305e424feac0d1b2c216be5f65ce7a95f0322ab3849478892ae407399aa6029a504c4c8a5884da

  • \Users\Admin\AppData\Local\Temp\.net\e36cb720d65332ede19b931c078296472dfad9e593a16005f18298eebec450dc\sqvgNfBSELMWQALuqeKShgkshhFO5Us=\coreclr.dll

    Filesize

    2.3MB

    MD5

    28eb36702cbb0258f749ec78b37d5d8e

    SHA1

    420e464b779eb73fe65e4ce77e6a5d95bff894ed

    SHA256

    6884784e25299747f5c2e2ab52cdd45872058b548fa9d3555bb501336a26530c

    SHA512

    b62541fe82c1772358686eeebd110ca5387878cfaa876bb07a15dba7e97d2ef1cd8ae663c670cc7d9d0e39bdcd80041e078fb05ea4dc4a893d83b30dd65654b9

  • memory/1212-12-0x000006448A000000-0x000006448A8F5000-memory.dmp

    Filesize

    9.0MB

  • memory/1212-15-0x000007FEF62D0000-0x000007FEF67DF000-memory.dmp

    Filesize

    5.1MB

  • memory/1212-18-0x0000000003200000-0x00000000036DE000-memory.dmp

    Filesize

    4.9MB

  • memory/1212-20-0x00000000003B0000-0x00000000003BA000-memory.dmp

    Filesize

    40KB

  • memory/1212-22-0x0000000001D50000-0x0000000001D6B000-memory.dmp

    Filesize

    108KB

  • memory/1212-25-0x00000000021F0000-0x0000000002233000-memory.dmp

    Filesize

    268KB

  • memory/1212-28-0x00000000003A0000-0x00000000003B0000-memory.dmp

    Filesize

    64KB

  • memory/1212-31-0x0000000002770000-0x00000000027B6000-memory.dmp

    Filesize

    280KB

  • memory/1212-34-0x00000000003C0000-0x00000000003C8000-memory.dmp

    Filesize

    32KB

  • memory/1212-37-0x0000000000680000-0x000000000068C000-memory.dmp

    Filesize

    48KB

  • memory/1212-40-0x00000000027C0000-0x00000000027ED000-memory.dmp

    Filesize

    180KB

  • memory/1212-43-0x00000000036E0000-0x0000000003795000-memory.dmp

    Filesize

    724KB

  • memory/1212-46-0x0000000000660000-0x0000000000679000-memory.dmp

    Filesize

    100KB

  • memory/1212-49-0x0000000003200000-0x00000000036DE000-memory.dmp

    Filesize

    4.9MB

  • memory/1212-51-0x0000000003200000-0x00000000036DE000-memory.dmp

    Filesize

    4.9MB

  • memory/1212-50-0x0000000003200000-0x00000000036DE000-memory.dmp

    Filesize

    4.9MB

  • memory/1212-52-0x0000000003200000-0x00000000036DE000-memory.dmp

    Filesize

    4.9MB

  • memory/1212-56-0x0000000003200000-0x00000000036DE000-memory.dmp

    Filesize

    4.9MB

  • memory/1212-57-0x0000000003200000-0x00000000036DE000-memory.dmp

    Filesize

    4.9MB

  • memory/1212-55-0x0000000003200000-0x00000000036DE000-memory.dmp

    Filesize

    4.9MB

  • memory/1212-54-0x0000000003200000-0x00000000036DE000-memory.dmp

    Filesize

    4.9MB

  • memory/1212-53-0x0000000003200000-0x00000000036DE000-memory.dmp

    Filesize

    4.9MB

  • memory/1212-58-0x0000000003200000-0x00000000036DE000-memory.dmp

    Filesize

    4.9MB

  • memory/1212-60-0x0000000003200000-0x00000000036DE000-memory.dmp

    Filesize

    4.9MB

  • memory/1212-59-0x0000000003200000-0x00000000036DE000-memory.dmp

    Filesize

    4.9MB

  • memory/1212-64-0x0000000003200000-0x00000000036DE000-memory.dmp

    Filesize

    4.9MB

  • memory/1212-65-0x0000000003200000-0x00000000036DE000-memory.dmp

    Filesize

    4.9MB

  • memory/1212-66-0x0000000003200000-0x00000000036DE000-memory.dmp

    Filesize

    4.9MB

  • memory/1212-63-0x0000000003200000-0x00000000036DE000-memory.dmp

    Filesize

    4.9MB

  • memory/1212-62-0x0000000003200000-0x00000000036DE000-memory.dmp

    Filesize

    4.9MB

  • memory/1212-61-0x0000000003200000-0x00000000036DE000-memory.dmp

    Filesize

    4.9MB

  • memory/1212-68-0x0000000003200000-0x00000000036DE000-memory.dmp

    Filesize

    4.9MB

  • memory/1212-69-0x0000000003200000-0x00000000036DE000-memory.dmp

    Filesize

    4.9MB

  • memory/1212-70-0x0000000003200000-0x00000000036DE000-memory.dmp

    Filesize

    4.9MB

  • memory/1212-71-0x0000000003200000-0x00000000036DE000-memory.dmp

    Filesize

    4.9MB

  • memory/1212-67-0x0000000003200000-0x00000000036DE000-memory.dmp

    Filesize

    4.9MB

  • memory/1212-73-0x0000000003200000-0x00000000036DE000-memory.dmp

    Filesize

    4.9MB

  • memory/1212-72-0x0000000003200000-0x00000000036DE000-memory.dmp

    Filesize

    4.9MB

  • memory/1212-76-0x0000000003200000-0x00000000036DE000-memory.dmp

    Filesize

    4.9MB

  • memory/1212-77-0x0000000003200000-0x00000000036DE000-memory.dmp

    Filesize

    4.9MB

  • memory/1212-75-0x0000000003200000-0x00000000036DE000-memory.dmp

    Filesize

    4.9MB

  • memory/1212-74-0x0000000003200000-0x00000000036DE000-memory.dmp

    Filesize

    4.9MB

  • memory/1212-78-0x0000000003200000-0x00000000036DE000-memory.dmp

    Filesize

    4.9MB

  • memory/1212-1645-0x000007FEF62D0000-0x000007FEF67DF000-memory.dmp

    Filesize

    5.1MB

  • memory/1212-2822-0x0000000000690000-0x0000000000691000-memory.dmp

    Filesize

    4KB

  • memory/1212-2912-0x0000000005A60000-0x0000000005AE0000-memory.dmp

    Filesize

    512KB

  • memory/1212-2978-0x0000000005A60000-0x0000000005AE0000-memory.dmp

    Filesize

    512KB