Analysis
-
max time kernel
119s -
max time network
140s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
11-03-2024 22:07
Static task
static1
Behavioral task
behavioral1
Sample
606a9693f9671c42e04bf5c81d46bf8c30c78dea75311504c09a7bc23ffbd3cf.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
606a9693f9671c42e04bf5c81d46bf8c30c78dea75311504c09a7bc23ffbd3cf.exe
Resource
win10v2004-20240226-en
General
-
Target
606a9693f9671c42e04bf5c81d46bf8c30c78dea75311504c09a7bc23ffbd3cf.exe
-
Size
96KB
-
MD5
8e91a8f725c2dfead6e576a5a4aebd42
-
SHA1
609b25a05b3fee17a3af8b9267c5005e6906787d
-
SHA256
606a9693f9671c42e04bf5c81d46bf8c30c78dea75311504c09a7bc23ffbd3cf
-
SHA512
253a6c0807977136bc29f506cffd0da84399963d937b4618d21ce837ad1c80e946a0a9d5e56431af35a1ccc2d579f24ef2c3ca1efe9fe22d1e40381581c40598
-
SSDEEP
1536:G1zzy48untU8fOMEI3jyYf6iuOBq1mPK3WWIthoBa:8zltUeOsBnqEMWWIthog
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2764 wrote to memory of 2976 2764 606a9693f9671c42e04bf5c81d46bf8c30c78dea75311504c09a7bc23ffbd3cf.exe 29 PID 2764 wrote to memory of 2976 2764 606a9693f9671c42e04bf5c81d46bf8c30c78dea75311504c09a7bc23ffbd3cf.exe 29 PID 2764 wrote to memory of 2976 2764 606a9693f9671c42e04bf5c81d46bf8c30c78dea75311504c09a7bc23ffbd3cf.exe 29 PID 2764 wrote to memory of 2976 2764 606a9693f9671c42e04bf5c81d46bf8c30c78dea75311504c09a7bc23ffbd3cf.exe 29 PID 2976 wrote to memory of 2396 2976 cmd.exe 30 PID 2976 wrote to memory of 2396 2976 cmd.exe 30 PID 2976 wrote to memory of 2396 2976 cmd.exe 30 PID 2976 wrote to memory of 2396 2976 cmd.exe 30 PID 2396 wrote to memory of 2392 2396 iexpress.exe 31 PID 2396 wrote to memory of 2392 2396 iexpress.exe 31 PID 2396 wrote to memory of 2392 2396 iexpress.exe 31 PID 2396 wrote to memory of 2392 2396 iexpress.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\606a9693f9671c42e04bf5c81d46bf8c30c78dea75311504c09a7bc23ffbd3cf.exe"C:\Users\Admin\AppData\Local\Temp\606a9693f9671c42e04bf5c81d46bf8c30c78dea75311504c09a7bc23ffbd3cf.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2764 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\6F47.tmp\1.bat" "C:\Users\Admin\AppData\Local\Temp\606a9693f9671c42e04bf5c81d46bf8c30c78dea75311504c09a7bc23ffbd3cf.exe""2⤵
- Suspicious use of WriteProcessMemory
PID:2976 -
C:\Windows\SysWOW64\iexpress.exeiexpress /n /q /m C:\Users\Admin\AppData\Local\Temp\popup.sed3⤵
- Suspicious use of WriteProcessMemory
PID:2396 -
C:\Windows\SysWOW64\makecab.exeC:\Windows\SysWOW64\makecab.exe /f "~%TargetName%.DDF"4⤵PID:2392
-
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD502dba5f37067292355c6d01a57d4ef48
SHA17c67ab3f99fbf7a53018dd295d2968c525db83d9
SHA2568b74c812ba9e6c536da7edd4101e7e0dddeab8355e5aff095dd31b3f00560242
SHA51212201f949ee3198c8f4b39cc8edf90a114ecf42ddd5383ed0b87e4c78053cd517786dc7af83557e63a0483af74f4c0117d5568441ae761ff6958e758704d602a
-
Filesize
96KB
MD5e350b8477933149e7bda0f9a8f2359c7
SHA17cb89ee59f078efe7228ef1f4805154006854ced
SHA2566d31221657d21fb3f3117359e30121f380b830704b1adccfe583f01d2a3f2a97
SHA512a6e30cd8c13445243908d7f1551ceb368d5a115cf26bec4ec118af94d690494515fd86c0f810382175ca176c460bb6b70eed6d06069d3188f6356bb22fc6ce59
-
Filesize
724B
MD5c3ca008abd6997c4b036a7e8be75cb2c
SHA105f7a3527bb04c691b08f040f562582035398829
SHA25629ef6bf47dcc8c67f1abe1b269d3518d6a4ebe125daa1ea460779638cb9782a3
SHA512bee0baf3cb83144239077f99f5ca2a6ca7b618f7f51a53e03613ae697e8bc76fa28f5d006296b469be8e1fffeeb35668b5fe87b260b1380cc003815ea9efb083