db1246b73a43950a9ab702ec62f5e11c7b99d32df8fc06de2a6270b4706b56b6

Analysis

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
09-03-2024 10:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

db1246b73a43950a9ab702ec62f5e11c7b99d32df8fc06de2a6270b4706b56b6.exe
Size

816KB
MD5

b839fc872ccde58809f3eb72d0c6960a
SHA1

510d05a3b1024b8f172b672f8440df41b51be2a4
SHA256

db1246b73a43950a9ab702ec62f5e11c7b99d32df8fc06de2a6270b4706b56b6
SHA512

07177c4ee742c908c1a9304b323dd7e3b3a8e78cf1c82af5e50fbbbe3d29060ec1b721b97a15ec11860743e4957ae92f04e61b52de9a5fa35a33f980f6332fd0
SSDEEP

24576:7Y4G2qLMJalsnqShyoo77lUabuSvbDQOOdIxJsG9g:U3XZynV4oDabuWbDQOcIxJJ9g

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2860	1E0F0C0C120D156C155A15A0C0C160B0D160A.exe

Loads dropped DLL 2 IoCs

pid	Process
2800	db1246b73a43950a9ab702ec62f5e11c7b99d32df8fc06de2a6270b4706b56b6.exe
2800	db1246b73a43950a9ab702ec62f5e11c7b99d32df8fc06de2a6270b4706b56b6.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2800	db1246b73a43950a9ab702ec62f5e11c7b99d32df8fc06de2a6270b4706b56b6.exe
2860	1E0F0C0C120D156C155A15A0C0C160B0D160A.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2800 wrote to memory of 2860	2800	db1246b73a43950a9ab702ec62f5e11c7b99d32df8fc06de2a6270b4706b56b6.exe	28
PID 2800 wrote to memory of 2860	2800	db1246b73a43950a9ab702ec62f5e11c7b99d32df8fc06de2a6270b4706b56b6.exe	28
PID 2800 wrote to memory of 2860	2800	db1246b73a43950a9ab702ec62f5e11c7b99d32df8fc06de2a6270b4706b56b6.exe	28
PID 2800 wrote to memory of 2860	2800	db1246b73a43950a9ab702ec62f5e11c7b99d32df8fc06de2a6270b4706b56b6.exe	28

C:\Users\Admin\AppData\Local\Temp\db1246b73a43950a9ab702ec62f5e11c7b99d32df8fc06de2a6270b4706b56b6.exe
"C:\Users\Admin\AppData\Local\Temp\db1246b73a43950a9ab702ec62f5e11c7b99d32df8fc06de2a6270b4706b56b6.exe"
1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:2800
- C:\Users\Admin\AppData\Local\Temp\1E0F0C0C120D156C155A15A0C0C160B0D160A.exe
  C:\Users\Admin\AppData\Local\Temp\1E0F0C0C120D156C155A15A0C0C160B0D160A.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:2860

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\1E0F0C0C120D156C155A15A0C0C160B0D160A.exe

Filesize
64KB

MD5
c65c09ec4b1c9baf638de30c401cde8a

SHA1
931c6ef4d724236248b8a3a757c85e6c99d80e6c

SHA256
af07d4e7f59bedaed0b31d7f33e9f04ebfbf1fd862a679ea1e8ea7140543985d

SHA512
9ea0b3684305b68d50b0f0f2c18b813eda94fa4b6f04f172330f170f3f19483d5dfaa1091c02a3a9ffd4f00a394fdbd9e5386a4fc619a9e419def31898028124

Download Submit
C:\Users\Admin\AppData\Local\Temp\1E0F0C0C120D156C155A15A0C0C160B0D160A.exe

Filesize
256KB

MD5
553be81e3d2b202e177a5477e5614643

SHA1
2297caf2a82f4846ba8d89dd1f3c64f9a74c7dcf

SHA256
194f129007369bcc783885214e2abd11599940ae77784393ec393b9b45b38ee6

SHA512
b442745ff5307ff989b9a572a01ab620a374f255456df9825de033227743128699a23176988c8ec70ad8298034ad3509fa9ed2436b87b66a9699e595e3aec59d

Download Submit
\Users\Admin\AppData\Local\Temp\1E0F0C0C120D156C155A15A0C0C160B0D160A.exe

Filesize
448KB

MD5
cb77f8376a7e0368788b007499b249c0

SHA1
160a038bfb61148f7963cfe95157427c313c4d30

SHA256
303c25df150133f633d0da431f84dc9806b35a47f25d964308dce2dc7ede3e0e

SHA512
f94e85befe67a2ccea0a2c5d040c5e4260c9e66426780cd1c4685b9c3ed3a4e395885400529acf18b6eaf85072bae5b024215ef40a6a396868d7116030e4bafd

Download Submit
memory/2800-0-0x0000000000400000-0x00000000005AD000-memory.dmp

Filesize
1.7MB

Download
memory/2800-1-0x0000000000400000-0x00000000005AD000-memory.dmp

Filesize
1.7MB

Download
memory/2800-12-0x0000000002080000-0x000000000222D000-memory.dmp

Filesize
1.7MB

Download
memory/2800-11-0x0000000000400000-0x00000000005AD000-memory.dmp

Filesize
1.7MB

Download
memory/2860-14-0x0000000000400000-0x00000000005AD000-memory.dmp

Filesize
1.7MB

Download
memory/2860-16-0x0000000000400000-0x00000000005AD000-memory.dmp

Filesize
1.7MB

Download
memory/2860-15-0x0000000000400000-0x00000000005AD000-memory.dmp

Filesize
1.7MB

Download
memory/2860-17-0x0000000000400000-0x00000000005AD000-memory.dmp

Filesize
1.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads